discordrat | a454b5af7b6d4377ecf7766236b85c8215acc5e75ecc66bdb2295206072eb1de

Analysis

max time kernel
54s
max time network
20s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-03-2024 02:36

Target

Client-built.exe
Size

78KB
MD5

581472806ad1a9b57b1303009c055f6f
SHA1

e1749dc8bd587864b3b7eb22a382dae504d28b22
SHA256

a454b5af7b6d4377ecf7766236b85c8215acc5e75ecc66bdb2295206072eb1de
SHA512

8cd52682cf2ce1f185ef806bc430fb5f6ef778ab84bb946bec38bb8208de2ffb9e3f54d66ff3976bda8847ffad41b0e6ced0287c9dedeea6db88f165e7fe45a8
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+zPIC:5Zv5PDwbjNrmAE+rIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTIxMzY3MTgwOTA5ODk4MTQxNw.GGCBxR.5S1itDEeG4YMcf47sxOpAbZIhGueKTU-pePqd0
server_id
1212597579477426226

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2572	2460	Client-built.exe	28
PID 2460 wrote to memory of 2572	2460	Client-built.exe	28
PID 2460 wrote to memory of 2572	2460	Client-built.exe	28

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2460 -s 600
  2⤵
  PID:2572

memory/2460-0-0x000000013F670000-0x000000013F688000-memory.dmp

Filesize
96KB

Download
memory/2460-1-0x000007FEF5C40000-0x000007FEF662C000-memory.dmp

Filesize
9.9MB

Download
memory/2460-2-0x000000001BCC0000-0x000000001BD40000-memory.dmp

Filesize
512KB

Download
memory/2460-3-0x000007FEF5C40000-0x000007FEF662C000-memory.dmp

Filesize
9.9MB

Download
memory/2460-4-0x000000001BCC0000-0x000000001BD40000-memory.dmp

Filesize
512KB

Download