discordrat | 4f1f07f7fe2572f02cb7ee748e994081684c23132e98a022f7a3ffaaec1753e9 | Triage

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/02/2025, 23:59

Sharing

Report Analysis Logs

General

Target

PikacuTestCATrusterSetup1.exe
Size

78KB
MD5

951de53e5a15496809d229467f9bd06c
SHA1

78c56e0ac8c1deee143387c06c32f0cd06a1b62c
SHA256

4f1f07f7fe2572f02cb7ee748e994081684c23132e98a022f7a3ffaaec1753e9
SHA512

6950aad78896605bc210486c4e373462f893f0fda60f07a338ad7c114d04093cc537a7890bad7e787648764ad64d34805f28ae256a07c448d74f83c485811e34
SSDEEP

1536:r2WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+FPIC:rZv5PDwbjNrmAE+VIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMxOTQ0NzE2Njc5NTY0OTA3NA.GSua6l.BHis8NFhnGhvzs_sNcA7gxK12CE-dopfaLfAO
server_id
1343684421986943051

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2948	2704	PikacuTestCATrusterSetup1.exe	30
PID 2704 wrote to memory of 2948	2704	PikacuTestCATrusterSetup1.exe	30
PID 2704 wrote to memory of 2948	2704	PikacuTestCATrusterSetup1.exe	30

C:\Users\Admin\AppData\Local\Temp\PikacuTestCATrusterSetup1.exe
"C:\Users\Admin\AppData\Local\Temp\PikacuTestCATrusterSetup1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2704 -s 596
  2⤵
  PID:2948

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2704-0-0x000007FEF5BC3000-0x000007FEF5BC4000-memory.dmp

Filesize
4KB

Download
memory/2704-1-0x000000013F470000-0x000000013F488000-memory.dmp

Filesize
96KB

Download
memory/2704-2-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download
memory/2704-3-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp

Filesize
9.9MB

Download