discordrat | 710b8c5bccffe277c66749c5fe619f6e7045e03abe5348dd2ed92fdef6656010

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 09:53

Target

Client-built.exe
Size

78KB
MD5

9495eec701db55246fda194795a75888
SHA1

2906defaaac8efaaabedb5f2570f1a8474f7fc76
SHA256

710b8c5bccffe277c66749c5fe619f6e7045e03abe5348dd2ed92fdef6656010
SHA512

ff5aea673c67a94d76c6e91f6eea9bbc0041bab8b1e24cc6405fbc8ea669db167560eabe68c557cbe751a8ad0935a59b33abab910f3256ac59a50eeece257035
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+1PIC:5Zv5PDwbjNrmAE+lIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTIxMTA5OTM2NzcyMTc5NTYzNA.GHiRHA.GfRaR5LYgOWQ3r28LpH37-iYeYmiGP1nEIR7es
server_id
1211092147235987486

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2428	2208	Client-built.exe	28
PID 2208 wrote to memory of 2428	2208	Client-built.exe	28
PID 2208 wrote to memory of 2428	2208	Client-built.exe	28

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2208 -s 600
  2⤵
  PID:2428

memory/2208-0-0x000000013FCA0000-0x000000013FCB8000-memory.dmp

Filesize
96KB

Download
memory/2208-1-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download
memory/2208-2-0x0000000000770000-0x00000000007F0000-memory.dmp

Filesize
512KB

Download
memory/2208-3-0x000007FEF5790000-0x000007FEF617C000-memory.dmp

Filesize
9.9MB

Download
memory/2208-4-0x0000000000770000-0x00000000007F0000-memory.dmp

Filesize
512KB

Download