discordrat | 3b675a52dfa1c46e2ab9d8632161e52727b2028d67c676ee801d34fe6550aab7

Resubmissions

13-03-2024 09:52

13-03-2024 09:40

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-03-2024 09:52

Target

Main/RUN_ME.bat
Size

20B
MD5

e33b065e04e13f92aa194ddb6f7bb9d8
SHA1

0c651171deee149f84e8feee2eeef678ee19b581
SHA256

a2ff24b8dbd5f24390c24092f83b2deaadae82bc588e50ca1c618b22ee3f8ec2
SHA512

155d0a18ffac00414250061c1010508a9c7b512dd0b0910a154655dc9e0e0dc5950762776c3c8195ad28797a661d49e25c5e2496e217457f8824bb58a7805b3a

Score

10^/10

Family

discordrat

Attributes

discord_token
MTIxNzA3NzI2Njc5OTEzMjc5NA.G6xQaE.4zXFoh6BPZlAIhLi46DSS2BaJjbxuU5eXQ1tP8
server_id
1190067527355744316

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 3040	1224	cmd.exe	29
PID 1224 wrote to memory of 3040	1224	cmd.exe	29
PID 1224 wrote to memory of 3040	1224	cmd.exe	29
PID 3040 wrote to memory of 2472	3040	build.exe	30
PID 3040 wrote to memory of 2472	3040	build.exe	30
PID 3040 wrote to memory of 2472	3040	build.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Main\RUN_ME.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Users\Admin\AppData\Local\Temp\Main\build.exe
  build.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 3040 -s 596
    3⤵
    PID:2472

memory/3040-0-0x000000013F790000-0x000000013F7A8000-memory.dmp

Filesize
96KB

Download
memory/3040-1-0x000007FEF61C0000-0x000007FEF6BAC000-memory.dmp

Filesize
9.9MB

Download
memory/3040-2-0x000000001BB40000-0x000000001BBC0000-memory.dmp

Filesize
512KB

Download
memory/3040-3-0x000007FEF61C0000-0x000007FEF6BAC000-memory.dmp

Filesize
9.9MB

Download
memory/3040-4-0x000000001BB40000-0x000000001BBC0000-memory.dmp

Filesize
512KB

Download