discordrat | eb2cd837b0019b8b749f26848f79987728ba6eeaefac717ae295aec3d77f6d41

Resubmissions

03-03-2024 01:44

03-03-2024 01:39

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-03-2024 01:39

Target

Client-built.exe
Size

78KB
MD5

29abd40a4fd8ef178c87129181a4fd73
SHA1

bab65aa718e97d07bd0e0732d167333502460f13
SHA256

eb2cd837b0019b8b749f26848f79987728ba6eeaefac717ae295aec3d77f6d41
SHA512

a9df4364f8b4953336b221266f4035e395fbddea8a22b49c96b3d0603c8e6530fff4decdd843a98d0cb3e7ed77bfe2bbcf8e0952f11b6838eb941cff5236fe02
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+OPIC:5Zv5PDwbjNrmAE+qIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTIxMzY1NjQ2NDQyMjYwMDc1NA.GmONnQ.zvgoeyWByXkk--Y3X0yBfX91brnJEV1TfpkkEI
server_id
1213656241784758272

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 3024	2120	Client-built.exe	28
PID 2120 wrote to memory of 3024	2120	Client-built.exe	28
PID 2120 wrote to memory of 3024	2120	Client-built.exe	28

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2120 -s 596
  2⤵
  PID:3024

memory/2120-0-0x000000013F720000-0x000000013F738000-memory.dmp

Filesize
96KB

Download
memory/2120-1-0x000007FEF55B0000-0x000007FEF5F9C000-memory.dmp

Filesize
9.9MB

Download
memory/2120-2-0x000000001BAD0000-0x000000001BB50000-memory.dmp

Filesize
512KB

Download
memory/2120-3-0x000007FEF55B0000-0x000007FEF5F9C000-memory.dmp

Filesize
9.9MB

Download
memory/2120-4-0x000000001BAD0000-0x000000001BB50000-memory.dmp

Filesize
512KB

Download