discordrat | ea2cda86a79603adb9534c86a07d1baa77b0665df53bd532d6821b052e9e5bbc

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-02-2024 01:35

Target

783e28b79d9b61b9ecfb67a64f651c72.exe
Size

78KB
MD5

783e28b79d9b61b9ecfb67a64f651c72
SHA1

b0aa8931c68412d95a8640f61b9101a775566eea
SHA256

ea2cda86a79603adb9534c86a07d1baa77b0665df53bd532d6821b052e9e5bbc
SHA512

61b8de222da9dea04175fc8e1681316c2fb62f05f02a5eb7ced3d9c0cfc4b9d180c51d7f726864aecc3d1d7e2a9c7064600b86791ee12b29420d448d783ba5c8
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+0PIC:5Zv5PDwbjNrmAE+oIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTIxMjE1MDkxOTg3NDA5MzEzNw.GeLSWI.MKcSkYNp5RM4q9EeuYqDGl6d7V-_O2LZmUv0gg
server_id
1212150729611939930

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2204	3052	783e28b79d9b61b9ecfb67a64f651c72.exe	1
PID 3052 wrote to memory of 2204	3052	783e28b79d9b61b9ecfb67a64f651c72.exe	1
PID 3052 wrote to memory of 2204	3052	783e28b79d9b61b9ecfb67a64f651c72.exe	1

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3052 -s 596
1⤵
PID:2204

C:\Users\Admin\AppData\Local\Temp\783e28b79d9b61b9ecfb67a64f651c72.exe
"C:\Users\Admin\AppData\Local\Temp\783e28b79d9b61b9ecfb67a64f651c72.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3052

memory/3052-2-0x000000001BA90000-0x000000001BB10000-memory.dmp

Filesize
512KB

Download
memory/3052-1-0x000007FEF5330000-0x000007FEF5D1C000-memory.dmp

Filesize
9.9MB

Download
memory/3052-0-0x000000013FDF0000-0x000000013FE08000-memory.dmp

Filesize
96KB

Download
memory/3052-3-0x000007FEF5330000-0x000007FEF5D1C000-memory.dmp

Filesize
9.9MB

Download
memory/3052-4-0x000000001BA90000-0x000000001BB10000-memory.dmp

Filesize
512KB

Download