discordrat | 982d2af6984f4d174d9ba00b6b548f0d1bd77b6e57e1cd8598cff1b72258e8b4

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/03/2024, 22:57

Target

Client-built (1).exe
Size

78KB
MD5

f0f7610e75c179a2c6951dcb0327a620
SHA1

2842d19dba4f864b01b0f79099112e3f2270fc73
SHA256

982d2af6984f4d174d9ba00b6b548f0d1bd77b6e57e1cd8598cff1b72258e8b4
SHA512

d6b8ae30dc6c90395a390291974fb1739e11f07abb28658aca16cf52943889f2dde65348bb4090df6b35675be3328df54d06a486ba9c2554bfeaa5bc31e807bb
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+DPIC:5Zv5PDwbjNrmAE+bIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTA0Mjg5Nzc5NjI4MzUxNTAyMQ.GwLuSI.-JtDOxtUKRFf8CsfEGNc01y0RB5GsjOPPqo0jw
server_id
1211783090137997403

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2588	2256	Client-built (1).exe	28
PID 2256 wrote to memory of 2588	2256	Client-built (1).exe	28
PID 2256 wrote to memory of 2588	2256	Client-built (1).exe	28

C:\Users\Admin\AppData\Local\Temp\Client-built (1).exe
"C:\Users\Admin\AppData\Local\Temp\Client-built (1).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2256 -s 596
  2⤵
  PID:2588

memory/2256-0-0x000000013F220000-0x000000013F238000-memory.dmp

Filesize
96KB

Download
memory/2256-1-0x000007FEF5720000-0x000007FEF610C000-memory.dmp

Filesize
9.9MB

Download
memory/2256-2-0x000000001B9F0000-0x000000001BA70000-memory.dmp

Filesize
512KB

Download
memory/2256-3-0x000007FEF5720000-0x000007FEF610C000-memory.dmp

Filesize
9.9MB

Download
memory/2256-4-0x000000001B9F0000-0x000000001BA70000-memory.dmp

Filesize
512KB

Download