discordrat | 0cd8c108e213285ce93c085181e35a446d040b788338acab6ff8d02f9620a572

Analysis

max time kernel
1559s
max time network
1563s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
08-04-2024 06:25

Target

Client-built.exe
Size

78KB
MD5

f131e9a605657417a6d9ee4897236762
SHA1

e673c6da09e605351bd12c596292621ca1c1a063
SHA256

0cd8c108e213285ce93c085181e35a446d040b788338acab6ff8d02f9620a572
SHA512

cddeba715d9fb981f86d67449dc989c3472286ec97f3de2773f770582cdcea3071222fcd94d6286a2800b83fcb845001bac0175e664a1e7d8aa07e8dff70cb9e
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+APIC:5Zv5PDwbjNrmAE+kIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTIxNjIxNTUyNTI4MjI4MzU4MA.GBK6jN.COZl9FTvEhXWGR_iVRAo7f9RXb-CLOQVgRSCWA
server_id
1216215871526277180

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1764	1980	Client-built.exe	28
PID 1980 wrote to memory of 1764	1980	Client-built.exe	28
PID 1980 wrote to memory of 1764	1980	Client-built.exe	28

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1980 -s 600
  2⤵
  PID:1764

memory/1980-0-0x000000013F520000-0x000000013F538000-memory.dmp

Filesize
96KB

Download
memory/1980-1-0x000007FEF5B10000-0x000007FEF64FC000-memory.dmp

Filesize
9.9MB

Download
memory/1980-2-0x0000000000730000-0x00000000007B0000-memory.dmp

Filesize
512KB

Download
memory/1980-3-0x000007FEF5B10000-0x000007FEF64FC000-memory.dmp

Filesize
9.9MB

Download
memory/1980-4-0x0000000000730000-0x00000000007B0000-memory.dmp

Filesize
512KB

Download
memory/1980-5-0x000007FEF5B10000-0x000007FEF64FC000-memory.dmp

Filesize
9.9MB

Download