discordrat | cccf75bb8d71a45d611a20d4b9df9a2be374e6dba127d7253b9bd26547f26940

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-03-2024 19:10

Target

Client-built.exe
Size

78KB
MD5

9ecf3ffd585a032ef28539df8ffff5a1
SHA1

a178641c7597f8e4b1009365f315840e6d67d450
SHA256

cccf75bb8d71a45d611a20d4b9df9a2be374e6dba127d7253b9bd26547f26940
SHA512

538ed095b0ff4cb27bab6b69ca3a62df632d9281112b558d41e61f921dab3ed3e74e10542de3b15c080c61c7d72f2c74ff7377419b01284989fab563f5233e35
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+BPIC:5Zv5PDwbjNrmAE+RIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTIxNTczNTAxNTkzODMyNjU1OQ.G9yV-B._jUdHx9XSQSo5nyttxH-78hmGvNbNE21hal5Tw
server_id
1215731392072122550

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 2308	1260	Client-built.exe	28
PID 1260 wrote to memory of 2308	1260	Client-built.exe	28
PID 1260 wrote to memory of 2308	1260	Client-built.exe	28

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1260 -s 600
  2⤵
  PID:2308

memory/1260-0-0x000000013FF40000-0x000000013FF58000-memory.dmp

Filesize
96KB

Download
memory/1260-1-0x000007FEF5860000-0x000007FEF624C000-memory.dmp

Filesize
9.9MB

Download
memory/1260-2-0x0000000000770000-0x00000000007F0000-memory.dmp

Filesize
512KB

Download
memory/1260-3-0x000007FEF5860000-0x000007FEF624C000-memory.dmp

Filesize
9.9MB

Download
memory/1260-4-0x0000000000770000-0x00000000007F0000-memory.dmp

Filesize
512KB

Download