discordrat | c1187d8399dc3af9eddd01c468d567f9318241b80e6af2a18554478a5a83c72e

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 05:50

Target

Client-built.exe
Size

78KB
MD5

1cf9e5b5799e91e63970ebfa421decd4
SHA1

7ac6c7dd36734209e4388ccf56b755c18799d7e6
SHA256

c1187d8399dc3af9eddd01c468d567f9318241b80e6af2a18554478a5a83c72e
SHA512

3f8327e661594aef57ad9ac73d63cc47804445e79ab488c30795c3bd6bf85eb5ba88870f55ce5cddfcc3c1a59764900c4bb72ab784b7030f88a2552933c5f37b
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+OPIC:5Zv5PDwbjNrmAE+qIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTE5NDE2OTc3MTUxMjU3ODA3MA.GCVqUn.o4RA4nS1nYlS1KBxh5Mcl5XC2rWkCuWIHze_qQ
server_id
1216981502819303504

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 340 wrote to memory of 2740	340	Client-built.exe	28
PID 340 wrote to memory of 2740	340	Client-built.exe	28
PID 340 wrote to memory of 2740	340	Client-built.exe	28

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:340
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 340 -s 596
  2⤵
  PID:2740

memory/340-0-0x000000013F6C0000-0x000000013F6D8000-memory.dmp

Filesize
96KB

Download
memory/340-1-0x000007FEF5E50000-0x000007FEF683C000-memory.dmp

Filesize
9.9MB

Download
memory/340-2-0x000000001BA70000-0x000000001BAF0000-memory.dmp

Filesize
512KB

Download
memory/340-3-0x000007FEF5E50000-0x000007FEF683C000-memory.dmp

Filesize
9.9MB

Download
memory/340-4-0x000000001BA70000-0x000000001BAF0000-memory.dmp

Filesize
512KB

Download