discordrat | 6fcdecc9bea18849982fc962f19dbff35800b68857828f9067445fa2ad9043d8

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-04-2024 16:44

Target

Client-built.exe
Size

78KB
MD5

73bb35a2d9edb0c75774504c77d4fe1a
SHA1

2778acd8f8ec9312682055101ce6f05d1af8766e
SHA256

6fcdecc9bea18849982fc962f19dbff35800b68857828f9067445fa2ad9043d8
SHA512

4c170b1f0789c934eda726889cdd56296c7ca889f8827e8e0e4ccede9d59fbe5609c81fb90b9aad76a6f70b1e5fa1ffe724f64aba5226c4e1e4a22116b43b9b1
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+WPIC:5Zv5PDwbjNrmAE+SIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTIyNzI5NzMwMDgyOTcwNDIzMg.GaL-Mz.7OpaKnisssDxfcMyaLFxIpl0ijjwXV1XP_O_RI
server_id
1225388594739281981

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 2860	1696	Client-built.exe	28
PID 1696 wrote to memory of 2860	1696	Client-built.exe	28
PID 1696 wrote to memory of 2860	1696	Client-built.exe	28

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1696 -s 600
  2⤵
  PID:2860

memory/1696-0-0x000000013FA40000-0x000000013FA58000-memory.dmp

Filesize
96KB

Download
memory/1696-1-0x000007FEF5320000-0x000007FEF5D0C000-memory.dmp

Filesize
9.9MB

Download
memory/1696-2-0x000000001BA10000-0x000000001BA90000-memory.dmp

Filesize
512KB

Download
memory/1696-3-0x000007FEF5320000-0x000007FEF5D0C000-memory.dmp

Filesize
9.9MB

Download
memory/1696-4-0x000000001BA10000-0x000000001BA90000-memory.dmp

Filesize
512KB

Download