discordrat | b5731cf4ba56ddcd02017d2fbf7f4713391d1c8fbb5f48bc8f7d28784682443f

Analysis

max time kernel
1556s
max time network
1561s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 15:25

Target

Client-built.exe
Size

78KB
MD5

4dcbcac4bc712059ec62b6276bd8be7e
SHA1

b51ebfde67f73153031951f42bfcf63bb6968c1a
SHA256

f45da39779bfeb23449fd590fba6c1060c76c1d645ab353c4805e6147a19f881
SHA512

a64c8c1af31045e8e3c8cb68ba05365ce6b97b6cdf343df1ae2dfa50aac560ca4bd14f6ef7c068050fc5a7c8d318c9d8b4f677bb0309e986a6968b29d6f0ae1c
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+TPIC:5Zv5PDwbjNrmAE+LIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTIwMjY0NTQ4MTE1NTcyMzMzNA.G6wgBI.2oRVj4YxDTKM8TSrsRNvAshgeJv9FC0pJXt6YE
server_id
1202645099088056350

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2032	2520	Client-built.exe	28
PID 2520 wrote to memory of 2032	2520	Client-built.exe	28
PID 2520 wrote to memory of 2032	2520	Client-built.exe	28

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2520 -s 600
  2⤵
  PID:2032

memory/2520-0-0x000000013FB50000-0x000000013FB68000-memory.dmp

Filesize
96KB

Download
memory/2520-1-0x000007FEF5CA0000-0x000007FEF668C000-memory.dmp

Filesize
9.9MB

Download
memory/2520-2-0x000000001B520000-0x000000001B5A0000-memory.dmp

Filesize
512KB

Download
memory/2520-3-0x000007FEF5CA0000-0x000007FEF668C000-memory.dmp

Filesize
9.9MB

Download
memory/2520-4-0x000000001B520000-0x000000001B5A0000-memory.dmp

Filesize
512KB

Download