discordrat | fb3089170bde18fdd08140d7b70c4ba3fca82bb9633a0eb25e88e5f163c18067

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 22:11

Target

Client-built.exe
Size

78KB
MD5

db899a12ca4041cacb6163330a39ae39
SHA1

d0916fd8b9643b15c8f224a29d837b1d85522438
SHA256

fb3089170bde18fdd08140d7b70c4ba3fca82bb9633a0eb25e88e5f163c18067
SHA512

e173469bd5cd7542532c3efcd3536ff977f0e46ba5af754d526f1a0862250ed652daab5da1f0462fc9a917a10d88fa652e4c7226b22897f58af25918d04f4166
SSDEEP

1536:82WjO8XeEXFZ5P7v88wbjNrfxCXhRoKV6+V+9PIC:8ZX5PDwbjNrmAE+tIC

Score

10^/10

Family

discordrat

Attributes

discord_token
https://discord.com/oauth2/authorize?client_id=1209977389786992680&permissions=8&scope=bot+applications.commands
server_id
https://discord.com/oauth2/authorize?client_id=1209977389786992680&permissions=8&scope=bot+applications.commands

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2528	2252	Client-built.exe	28
PID 2252 wrote to memory of 2528	2252	Client-built.exe	28
PID 2252 wrote to memory of 2528	2252	Client-built.exe	28

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2252 -s 600
  2⤵
  PID:2528

memory/2252-0-0x000000013F370000-0x000000013F388000-memory.dmp

Filesize
96KB

Download
memory/2252-1-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

Filesize
9.9MB

Download
memory/2252-2-0x000000001B920000-0x000000001B9A0000-memory.dmp

Filesize
512KB

Download
memory/2252-3-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

Filesize
9.9MB

Download
memory/2252-4-0x000000001B920000-0x000000001B9A0000-memory.dmp

Filesize
512KB

Download
memory/2252-5-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

Filesize
9.9MB

Download