discordrat | a9010003bacc975234c89399b708e3bf32140a01e26ab4da28cf68f2c8799157

Resubmissions

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13-04-2024 12:09

Target

ChromeInstallerOnline.exe
Size

78KB
MD5

751f7cc03ddcb53a3fdf0e6cc0dba454
SHA1

b85002ea831819271705d7ba2bf7bd7328631a84
SHA256

a9010003bacc975234c89399b708e3bf32140a01e26ab4da28cf68f2c8799157
SHA512

3b5b52c9a24d4bb22214af434fa8375a435b81a8e31339c5a4babb7f0d023690161e270dfba8a81cadebc0df67cb7b77b1ae63484eef80b56ff6df63a1ba761d
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+RPIC:5Zv5PDwbjNrmAE+BIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTE5MTc1ODU0NTA3OTc3MTIyNw.G5YEgr.tBtpWfyWjUI8p35eCosfi_smEYeHFjgpOnusAY
server_id
1055840436356390962

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2936	2060	ChromeInstallerOnline.exe	28
PID 2060 wrote to memory of 2936	2060	ChromeInstallerOnline.exe	28
PID 2060 wrote to memory of 2936	2060	ChromeInstallerOnline.exe	28

C:\Users\Admin\AppData\Local\Temp\ChromeInstallerOnline.exe
"C:\Users\Admin\AppData\Local\Temp\ChromeInstallerOnline.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2060 -s 596
  2⤵
  PID:2936

memory/2060-0-0x000000013F9B0000-0x000000013F9C8000-memory.dmp

Filesize
96KB

Download
memory/2060-1-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

Filesize
9.9MB

Download
memory/2060-2-0x000000001BBE0000-0x000000001BC60000-memory.dmp

Filesize
512KB

Download
memory/2060-3-0x000007FEF5870000-0x000007FEF625C000-memory.dmp

Filesize
9.9MB

Download
memory/2060-4-0x000000001BBE0000-0x000000001BC60000-memory.dmp

Filesize
512KB

Download