discordrat | a6901d6bcebc642d69c2bbb3f9a95894dd7dda5996228e9c53bd9031d6907f12

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
29-04-2024 17:52

Target

PUBLIC_BUILDER.exe
Size

78KB
MD5

2577987132c76aa19f9ae9fe96d09dc6
SHA1

07c7cb68c87764b46df3036e76d4665037056b8f
SHA256

a6901d6bcebc642d69c2bbb3f9a95894dd7dda5996228e9c53bd9031d6907f12
SHA512

58489f6e5301073d99a49560a441449ade8b84296ef1e4cc4de10a2417264367c2629fae17b0b266d36cd2e987fed3597e136e029de3e6e3c0e89d95f4f69dc4
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+bPIC:5Zv5PDwbjNrmAE+TIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTIyNzI4NTgxNDAwMjcxMjY3Nw.GH6-Te.segc67UT3QGCiNN9Dz1KyUMCU0C4_3QlNWc4vw
server_id
1227285777075933254

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2724	2484	PUBLIC_BUILDER.exe	28
PID 2484 wrote to memory of 2724	2484	PUBLIC_BUILDER.exe	28
PID 2484 wrote to memory of 2724	2484	PUBLIC_BUILDER.exe	28

C:\Users\Admin\AppData\Local\Temp\PUBLIC_BUILDER.exe
"C:\Users\Admin\AppData\Local\Temp\PUBLIC_BUILDER.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2484 -s 596
  2⤵
  PID:2724

memory/2484-0-0x000000013F160000-0x000000013F178000-memory.dmp

Filesize
96KB

Download
memory/2484-1-0x000007FEF5C60000-0x000007FEF664C000-memory.dmp

Filesize
9.9MB

Download
memory/2484-2-0x000000001B9E0000-0x000000001BA60000-memory.dmp

Filesize
512KB

Download
memory/2484-3-0x000007FEF5C60000-0x000007FEF664C000-memory.dmp

Filesize
9.9MB

Download
memory/2484-4-0x000000001B9E0000-0x000000001BA60000-memory.dmp

Filesize
512KB

Download