discordrat | a9010003bacc975234c89399b708e3bf32140a01e26ab4da28cf68f2c8799157

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
14-04-2024 01:36

Target

a9010003bacc975234c89399b708e3bf32140a01e26ab4da28cf68f2c8799157.exe
Size

78KB
MD5

751f7cc03ddcb53a3fdf0e6cc0dba454
SHA1

b85002ea831819271705d7ba2bf7bd7328631a84
SHA256

a9010003bacc975234c89399b708e3bf32140a01e26ab4da28cf68f2c8799157
SHA512

3b5b52c9a24d4bb22214af434fa8375a435b81a8e31339c5a4babb7f0d023690161e270dfba8a81cadebc0df67cb7b77b1ae63484eef80b56ff6df63a1ba761d
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+RPIC:5Zv5PDwbjNrmAE+BIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTE5MTc1ODU0NTA3OTc3MTIyNw.G5YEgr.tBtpWfyWjUI8p35eCosfi_smEYeHFjgpOnusAY
server_id
1055840436356390962

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
behavioral1/memory/2836-0-0x000000013F370000-0x000000013F388000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 1244	2836	a9010003bacc975234c89399b708e3bf32140a01e26ab4da28cf68f2c8799157.exe	28
PID 2836 wrote to memory of 1244	2836	a9010003bacc975234c89399b708e3bf32140a01e26ab4da28cf68f2c8799157.exe	28
PID 2836 wrote to memory of 1244	2836	a9010003bacc975234c89399b708e3bf32140a01e26ab4da28cf68f2c8799157.exe	28

C:\Users\Admin\AppData\Local\Temp\a9010003bacc975234c89399b708e3bf32140a01e26ab4da28cf68f2c8799157.exe
"C:\Users\Admin\AppData\Local\Temp\a9010003bacc975234c89399b708e3bf32140a01e26ab4da28cf68f2c8799157.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2836 -s 596
  2⤵
  PID:1244

memory/2836-0-0x000000013F370000-0x000000013F388000-memory.dmp

Filesize
96KB

Download
memory/2836-1-0x000007FEF5F40000-0x000007FEF692C000-memory.dmp

Filesize
9.9MB

Download
memory/2836-2-0x000000001B8C0000-0x000000001B940000-memory.dmp

Filesize
512KB

Download
memory/2836-3-0x000007FEF5F40000-0x000007FEF692C000-memory.dmp

Filesize
9.9MB

Download
memory/2836-4-0x000000001B8C0000-0x000000001B940000-memory.dmp

Filesize
512KB

Download