discordrat | b9cae0739fc6daee051551b3e1dfabd39db41c2996f3a905254a71def555ba36 | Triage

Analysis

max time kernel
9s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:25

Sharing

Report Analysis Logs

General

Target

60cefc41a36bd39b3ed821f809214b23.exe
Size

78KB
MD5

60cefc41a36bd39b3ed821f809214b23
SHA1

f0780b33e30d9fa6d9770d3582d8a89e6768a301
SHA256

cabdfa8ff32894fb52519e370cfba5ac756c32806914f9204ad0956ea656c4b1
SHA512

39a7f50d15e315aa0d7997bd2f42a017e2dfad156c880a114d14625f364445c2ff822be27cc76dd1040d7fd6d2aa22fe2c1b3ae2cfea3d85c47a1a9a6210ebd0
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+lPIC:5Zv5PDwbjNrmAE+1IC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTM1MjQ2NjU4OTkwNzI4ODE1OA.GfHicl.AEuZ5S8QHMK3yNCTq0R48v2K_yi1HMufrddt-o
server_id
1351278977636892915

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 1040	3016	60cefc41a36bd39b3ed821f809214b23.exe	29
PID 3016 wrote to memory of 1040	3016	60cefc41a36bd39b3ed821f809214b23.exe	29
PID 3016 wrote to memory of 1040	3016	60cefc41a36bd39b3ed821f809214b23.exe	29

C:\Users\Admin\AppData\Local\Temp\60cefc41a36bd39b3ed821f809214b23.exe
"C:\Users\Admin\AppData\Local\Temp\60cefc41a36bd39b3ed821f809214b23.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3016 -s 596
  2⤵
  PID:1040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3016-0-0x000007FEF64B3000-0x000007FEF64B4000-memory.dmp

Filesize
4KB

Download
memory/3016-1-0x000000013F120000-0x000000013F138000-memory.dmp

Filesize
96KB

Download
memory/3016-2-0x000007FEF64B0000-0x000007FEF6E9C000-memory.dmp

Filesize
9.9MB

Download
memory/3016-3-0x000007FEF64B0000-0x000007FEF6E9C000-memory.dmp

Filesize
9.9MB

Download