discordrat | 924da851c470c6b57bbfde9ee36383c2fa4f4d27e7948b91fbf2ede2839b6aad

Resubmissions

19/02/2024, 16:48

19/02/2024, 16:44

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/02/2024, 16:44

Target

Client-built.exe
Size

78KB
MD5

eb8348b6736cb45566c720496d15ce4f
SHA1

a871da195e107463c3d705e091dbbe73967aa44d
SHA256

924da851c470c6b57bbfde9ee36383c2fa4f4d27e7948b91fbf2ede2839b6aad
SHA512

11d53ca175cda68a342918c782fde9e7d50135d76a13468de52a89a2b9910a7db7385d63ab37cad594bc2ecd4f3f191b9b04915bb477068cfb2388dfba78244c
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+o9PIC:5Zv5PDwbjNrmAE+otIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTE2MTcxODMxMjE2Njc3Mjc4OA.GzfFXs.vZ1gjACnyFGrF4Kes0GxFlkFKdk_zqAzL8HtgE
server_id
1195408378034409594

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 3048	1936	Client-built.exe	28
PID 1936 wrote to memory of 3048	1936	Client-built.exe	28
PID 1936 wrote to memory of 3048	1936	Client-built.exe	28

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1936 -s 596
  2⤵
  PID:3048

memory/1936-0-0x000000013F6E0000-0x000000013F6F8000-memory.dmp

Filesize
96KB

Download
memory/1936-1-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download
memory/1936-2-0x0000000000760000-0x00000000007E0000-memory.dmp

Filesize
512KB

Download
memory/1936-3-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download
memory/1936-4-0x0000000000760000-0x00000000007E0000-memory.dmp

Filesize
512KB

Download