discordrat | 94940d4797679ad5859cdb3a32148976dc39af147a481afc4e8ec499ef5b241a

General

Target
2026-07-01_9f6239a760cacd2dd1fe2ea73728edbf_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 486KB
Sample260701-j5chkaby8x
SHA256 94940d4797679ad5859cdb3a32148976dc39af147a481afc4e8ec499ef5b241a
MD5 9f6239a760cacd2dd1fe2ea73728edbf
SHA1 1d7bc9fce4987806247e5c506780557dba8a771f
SHA512 e0a5a965cbe07d07cc519579295e813314973236abfae7945147cbb87539f5d1742b616d4d5a63fe50d63da8045c683b282cd17db084974269abc65f60f4ea2c
SSDEEP 6144:xRs9Djkimq76tIy5qHbh4ZkcRKCfmJLaImb4zG8GR4e/1Q4gJOlOIwpwsK:2ciZ4qN4ZkKdcLtmUzG8G4e9EOUIoJK
TLSH
T17CB47D19E7F405F9E1B3E578CE934902EB7778490771E68F03AC59A61F236908E39722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTQ4MjUzMjc3MjU0NjQ4MjI5Nw.Gr4LRK.KTn5vocr3EKVPI7wJgzv2pMw2bdIQXEfs352Ro
server_id
1521227248722509844

Signatures

Family: Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Detects executables containing URLs to raw contents of a Github gist 2 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c5c3-14.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/4516-19-0x000001807FB70000-0x000001807FB88000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Executes dropped EXE 1 IoCs

pid	Process
4516	Client-built.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings	2026-07-01_9f6239a760cacd2dd1fe2ea73728edbf_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{EEE06716-1C6F-46FD-8158-2F3EC33F0CED}	mspaint.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5768	mspaint.exe
5768	mspaint.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4516	Client-built.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5768	mspaint.exe
5768	mspaint.exe
5768	mspaint.exe
5768	mspaint.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 5768	4776	2026-07-01_9f6239a760cacd2dd1fe2ea73728edbf_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe	88
PID 4776 wrote to memory of 4516	4776	2026-07-01_9f6239a760cacd2dd1fe2ea73728edbf_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-07-01_9f6239a760cacd2dd1fe2ea73728edbf_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_9f6239a760cacd2dd1fe2ea73728edbf_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\_101830007_mediaitem101830006.png"
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5768
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:2148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Client-built.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe
Size 78KB
SHA256 d4a2036359894a950ba5e70a66d7cebed3f657f9508ff440e4625c813d9efae0
MD5 901f42c24213a25f30d4f41136d8842f
SHA1 c8f43e03d6bc3f55388b418d56fdb16780047ad6
SHA512 3751bcdbf971e1be9d7a1f8baf3e14178cafca78b8e3db9720966eacf4295f3cdc8421b25dfaf7bff9d54be27e2a0a66101347df8c0a16c1659af2dad3764c8b
SSDEEP 1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+LPIC:5Zv5PDwbjNrmAE+jIC
TLSH
T17873B8C877AD8D03FBBF5EBD147141524B72BB17E935F68D088C54E611A2B828C42B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_101830007_mediaitem101830006.png

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\_101830007_mediaitem101830006.png
Size 6KB
SHA256 ba8a912e2f17ff97c2f2bd324e0d25d43426c87b4e18b2f8190063159263fcac
MD5 8204836e075493f715f3d72fd3d40a77
SHA1 5b4b6e3fcae9a42e4d6e8193effb5ac7b869adf1
SHA512 abff84a35c1b8e6653f10e7a2a5e024f37346177d05c3b21885c49bf4f987d1aaafd588bff6896760bdb1afc7e68a896b77dc3346bcbcdf50ae589f6e62c9927
SSDEEP 192:LsRAo64/u898UYKtohOBxrZzAvAUOqSlXY13VLFt:LsRBr/l9cheFZz6fSubLFt
TLSH
T1CCE1AE863EF5E959FC5B10FB3748154CFC8689A98448E333A95D5EAF1F281E295AD008
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4516-19-0x000001807FB70000-0x000001807FB88000-memory.dmp

Download

memory/4516-20-0x0000018080130000-0x00000180802F2000-memory.dmp

Download

memory/4516-21-0x000001801A970000-0x000001801AE98000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads