discordrat | b9cae0739fc6daee051551b3e1dfabd39db41c2996f3a905254a71def555ba36 | Triage

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:25

Sharing

Report Analysis Logs

General

Target

6025a03430599ee8e8561987af97f145.exe
Size

78KB
MD5

6025a03430599ee8e8561987af97f145
SHA1

9ab43188bd8054f0bce0891a13b2387a79afc1b3
SHA256

40109b15ee4560f27cafb2329d4301b1c7e752580cc96390c2d335b65f5d57c6
SHA512

d247be89db096e74139333f5157be98801258e7cbee0dbd9d42cc4307a8dcd3f358c58886abb9e33958a1cead3e4c51d2c2a056f224e2235b83197df149f1c7c
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+kPIC:5Zv5PDwbjNrmAE+4IC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTM1MjA1NzMyNDc3NjE5NDA2OA.G42d3M.lPgGGTTkVtqnMENPX_QaLq5UCf1wXmylAYB_Nk
server_id
1352056934202740847

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 1760	2176	6025a03430599ee8e8561987af97f145.exe	30
PID 2176 wrote to memory of 1760	2176	6025a03430599ee8e8561987af97f145.exe	30
PID 2176 wrote to memory of 1760	2176	6025a03430599ee8e8561987af97f145.exe	30

C:\Users\Admin\AppData\Local\Temp\6025a03430599ee8e8561987af97f145.exe
"C:\Users\Admin\AppData\Local\Temp\6025a03430599ee8e8561987af97f145.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2176 -s 600
  2⤵
  PID:1760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2176-0-0x000007FEF5EC3000-0x000007FEF5EC4000-memory.dmp

Filesize
4KB

Download
memory/2176-1-0x000000013F530000-0x000000013F548000-memory.dmp

Filesize
96KB

Download
memory/2176-2-0x000007FEF5EC0000-0x000007FEF68AC000-memory.dmp

Filesize
9.9MB

Download
memory/2176-3-0x000007FEF5EC0000-0x000007FEF68AC000-memory.dmp

Filesize
9.9MB

Download