discordrat | da50be0c78d14cbb6775a20b3931709d24b43e9a286e6b2332702738e7f446b7

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-03-2024 20:10

Target

Client-built.exe
Size

78KB
MD5

46f9c93e8c23fc6a141112d808b0db4b
SHA1

18a9b864e2423bacf8a4df0c00af33110b7056c9
SHA256

da50be0c78d14cbb6775a20b3931709d24b43e9a286e6b2332702738e7f446b7
SHA512

88ee061d2050ac6cd7374b5045041632bd2b269dbbd7e776a203acc218b0c7689d345573388dbbb75d78d664fd5e9fb8a4712f4829c86f76622b77f4afb12ce1
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+NPIC:5Zv5PDwbjNrmAE+dIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTIyMDQ2MzE2MjQ0MTIwMzcxMw.GYQ5az.AGDj0cuA32CnsnJO447L6JL3tIvJBXOOIcodxI
server_id
1220462616271388692

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 2844	2144	Client-built.exe	28
PID 2144 wrote to memory of 2844	2144	Client-built.exe	28
PID 2144 wrote to memory of 2844	2144	Client-built.exe	28

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2144 -s 604
  2⤵
  PID:2844

memory/2144-0-0x000000013FFD0000-0x000000013FFE8000-memory.dmp

Filesize
96KB

Download
memory/2144-1-0x000007FEF5100000-0x000007FEF5AEC000-memory.dmp

Filesize
9.9MB

Download
memory/2144-2-0x000000001BAD0000-0x000000001BB50000-memory.dmp

Filesize
512KB

Download
memory/2144-3-0x000007FEF5100000-0x000007FEF5AEC000-memory.dmp

Filesize
9.9MB

Download
memory/2144-4-0x000000001BAD0000-0x000000001BB50000-memory.dmp

Filesize
512KB

Download