discordrat | 15ebd4b50634b51dabaeeea478fd1faf1660ba49762221904a9245507e2661d9

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
23-04-2024 17:58

Target

Client-built.exe
Size

78KB
MD5

78ef13008230bf07631247e4deb68cfa
SHA1

3732158bd610601c1762c4c59c3494079d7f6a19
SHA256

15ebd4b50634b51dabaeeea478fd1faf1660ba49762221904a9245507e2661d9
SHA512

fb8f97095c55a96ff6d848f68da915879ad6afe8463ef83d64f7e0c4371ad5e676589658f6d0d89b880cd16f7d2fb608bd0b2a32f2c9f5a44eb36651ade6ca0c
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+uPIC:5Zv5PDwbjNrmAE+KIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTIzMjM4MTY2MjM0MDU3OTQyOA.GY_aOC.vYTYl0_otrnb3S93vCggl45KvsMO1h2nAc9kfQ
server_id
1232381912262119557

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2472	2220	Client-built.exe	28
PID 2220 wrote to memory of 2472	2220	Client-built.exe	28
PID 2220 wrote to memory of 2472	2220	Client-built.exe	28

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2220 -s 600
  2⤵
  PID:2472

memory/2220-0-0x000000013F040000-0x000000013F058000-memory.dmp

Filesize
96KB

Download
memory/2220-1-0x000007FEF5CA0000-0x000007FEF668C000-memory.dmp

Filesize
9.9MB

Download
memory/2220-2-0x0000000002390000-0x0000000002410000-memory.dmp

Filesize
512KB

Download
memory/2220-3-0x000007FEF5CA0000-0x000007FEF668C000-memory.dmp

Filesize
9.9MB

Download
memory/2220-4-0x0000000002390000-0x0000000002410000-memory.dmp

Filesize
512KB

Download