discordrat | 3399e7313f7ade6b428434fe748bb0a16e8a79e85d29189fce0632e7d20256f0 | Triage

Resubmissions

27/02/2025, 15:25

250227-stmzla1shs 10

27/02/2025, 10:29

250227-mjanmavpw7 10

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/02/2025, 15:25

Sharing

Report Analysis Logs

General

Target

loader.exe
Size

78KB
MD5

41102bfb1023f5d14583c287d0702275
SHA1

1b1867ef91e737b565b7ae037a70aa4a1d02b907
SHA256

3399e7313f7ade6b428434fe748bb0a16e8a79e85d29189fce0632e7d20256f0
SHA512

cc5522d74391657f9df6bcbad60b461495cbbb5795a3dc941b080aabf7a138f2fe75335d43d1f56028e9b328e8dcad5cf457f5e0ce4e733bdc14c02dffc9b1e3
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+VPIC:5Zv5PDwbjNrmAE+FIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMwMzM2ODg2NDExMjk3MTg1Nw.Go1Mgw.q_ubdCtLWoHQdI0TkjmrQhxcEXZBXuuIFY9784
server_id
1311856539698597980

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2284	2112	loader.exe	30
PID 2112 wrote to memory of 2284	2112	loader.exe	30
PID 2112 wrote to memory of 2284	2112	loader.exe	30

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2112 -s 600
  2⤵
  PID:2284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2112-0-0x000007FEF5903000-0x000007FEF5904000-memory.dmp

Filesize
4KB

Download
memory/2112-1-0x000000013F370000-0x000000013F388000-memory.dmp

Filesize
96KB

Download
memory/2112-2-0x000007FEF5900000-0x000007FEF62EC000-memory.dmp

Filesize
9.9MB

Download
memory/2112-3-0x000007FEF5900000-0x000007FEF62EC000-memory.dmp

Filesize
9.9MB

Download