discordrat | be61908195a282c5b2219a310e213e1535c1b6a8fea71a74f67e8d382408ac19 | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 05:39

Sharing

Report Analysis Logs

General

Target

shibagold v20.exe
Size

78KB
MD5

fdf180973f29781ffd20205549805122
SHA1

c9e894fbbd21857a183f1040376e52ef350f9b65
SHA256

be61908195a282c5b2219a310e213e1535c1b6a8fea71a74f67e8d382408ac19
SHA512

05ea4088a93311323fab3049de04fe234a1f87af9330ed45090ec6e69914c7ca0142d62133b457454e5c967e0778197a3be815e37110a121c953d141fc27907d
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+MPIC:5Zv5PDwbjNrmAE+gIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI1Nzk1NzI4ODU0MzUyMjk0OA.GtAtvy.J82uIznsLsFpGK5JoP7XQa28oKocMNPC4n6aWI
server_id
1257954812113190942

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

shibagold v20.exe

description	pid	process	target process
PID 2148 wrote to memory of 2516	2148	shibagold v20.exe	WerFault.exe
PID 2148 wrote to memory of 2516	2148	shibagold v20.exe	WerFault.exe
PID 2148 wrote to memory of 2516	2148	shibagold v20.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\shibagold v20.exe
"C:\Users\Admin\AppData\Local\Temp\shibagold v20.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2148

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2148 -s 596
2⤵
PID:2516

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2148-0-0x000007FEF5523000-0x000007FEF5524000-memory.dmp

Filesize
4KB

Download
memory/2148-1-0x000000013F420000-0x000000013F438000-memory.dmp

Filesize
96KB

Download
memory/2148-2-0x000007FEF5520000-0x000007FEF5F0C000-memory.dmp

Filesize
9.9MB

Download
memory/2148-3-0x000007FEF5523000-0x000007FEF5524000-memory.dmp

Filesize
4KB

Download