discordrat | ab216a4c330fce82b5bf0449d35fd2d7d9c89a47c0d80e2278d272a99f420687

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 19:31

Target

Client-built.exe
Size

78KB
MD5

bc2d2dd6fe16371f18c219fa523d5c93
SHA1

7d1e801321c72587a7d0aa49e4f43555e7758789
SHA256

ab216a4c330fce82b5bf0449d35fd2d7d9c89a47c0d80e2278d272a99f420687
SHA512

174bd64722e56bcf14f4b4610894c4b332932e34e1bdd7c2421a63644ee24f8c86a2a9902579a8baaf44c91e70db9092e21196fc28e1cc621d4c28df385876d3
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+pPIC:5Zv5PDwbjNrmAE+ZIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTEwNjU4NzkwNTg0MzAxNTczMQ.Gy9GZf.nefUfqGXXz1F_0UeH8PUa3eemxkDVD-rvvZ3VI
server_id
1215373982082146314

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 2308	1288	Client-built.exe	28
PID 1288 wrote to memory of 2308	1288	Client-built.exe	28
PID 1288 wrote to memory of 2308	1288	Client-built.exe	28

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1288 -s 596
  2⤵
  PID:2308

memory/1288-0-0x000000013F600000-0x000000013F618000-memory.dmp

Filesize
96KB

Download
memory/1288-1-0x000007FEF5310000-0x000007FEF5CFC000-memory.dmp

Filesize
9.9MB

Download
memory/1288-2-0x000000001B950000-0x000000001B9D0000-memory.dmp

Filesize
512KB

Download
memory/1288-3-0x000007FEF5310000-0x000007FEF5CFC000-memory.dmp

Filesize
9.9MB

Download
memory/1288-4-0x000000001B950000-0x000000001B9D0000-memory.dmp

Filesize
512KB

Download
memory/1288-5-0x000007FEF5310000-0x000007FEF5CFC000-memory.dmp

Filesize
9.9MB

Download