discordrat | 003f4826529864be9025beb1980e3c45c083f7c13db8db93e619c6da1e241bf3 | Triage

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
05-07-2024 01:55

Sharing

Report Analysis Logs

General

Target

61aafea599d09a68d5340d5608f84233.exe
Size

78KB
MD5

61aafea599d09a68d5340d5608f84233
SHA1

6af9c778cd42a6b7c2ce074df3fd58ba28879102
SHA256

003f4826529864be9025beb1980e3c45c083f7c13db8db93e619c6da1e241bf3
SHA512

79bacbead0995525b0252c7ccdadb0d7a7a7585710273dfe21cd73ed0a24cb689ee4c0936350e8c0634b0f2bf30345af8496b6fc77dbf2b9d01f2b513be78c30
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+0PIC:5Zv5PDwbjNrmAE+oIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI1NjYyNDkzOTk3MzQ4MDYzOA.GGFK0n.GHWgf03QhLbLDi22Mnxm1GywDpUNxfPetussT4
server_id
1258096867728818177

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

61aafea599d09a68d5340d5608f84233.exe

description	pid	process	target process
PID 1280 wrote to memory of 2376	1280	61aafea599d09a68d5340d5608f84233.exe	WerFault.exe
PID 1280 wrote to memory of 2376	1280	61aafea599d09a68d5340d5608f84233.exe	WerFault.exe
PID 1280 wrote to memory of 2376	1280	61aafea599d09a68d5340d5608f84233.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\61aafea599d09a68d5340d5608f84233.exe
"C:\Users\Admin\AppData\Local\Temp\61aafea599d09a68d5340d5608f84233.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1280

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1280 -s 600
2⤵
PID:2376

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1280-0-0x000007FEF5A63000-0x000007FEF5A64000-memory.dmp

Filesize
4KB

Download
memory/1280-1-0x000000013F260000-0x000000013F278000-memory.dmp

Filesize
96KB

Download
memory/1280-2-0x000007FEF5A60000-0x000007FEF644C000-memory.dmp

Filesize
9.9MB

Download
memory/1280-3-0x000007FEF5A63000-0x000007FEF5A64000-memory.dmp

Filesize
4KB

Download