discordrat | 32c8aa288370fd70b1efa6caca518ee9889956cd2af338646027d6e1e1ccf385

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 17:22

Target

Client-built.exe
Size

78KB
MD5

bf49c381e1f491849a6b197ce59091a2
SHA1

60b070d49122d646113b8319d1d53a3dd9684831
SHA256

32c8aa288370fd70b1efa6caca518ee9889956cd2af338646027d6e1e1ccf385
SHA512

7c43354d293d2aff605a34e686ce5872140a90e05fd125eef9b30f01f0e661a7b6d442529a068d2ae6538622bc4a9132b09a0091b6952994b235c9d2db577567
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+rKPIC:5Zv5PDwbjNrmAE+qIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTIzMjQwMjQ1OTY1MDAzNTgxMw.GmfYkB.w4VWTLT1LsMRqc2UptmqpxHwQ9iS8vumwYxyW0
server_id
1232401551646003363

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2084	2028	Client-built.exe	28
PID 2028 wrote to memory of 2084	2028	Client-built.exe	28
PID 2028 wrote to memory of 2084	2028	Client-built.exe	28

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2028 -s 596
  2⤵
  PID:2084

memory/2028-0-0x000007FEF51F3000-0x000007FEF51F4000-memory.dmp

Filesize
4KB

Download
memory/2028-1-0x000000013F320000-0x000000013F338000-memory.dmp

Filesize
96KB

Download
memory/2028-2-0x000007FEF51F0000-0x000007FEF5BDC000-memory.dmp

Filesize
9.9MB

Download
memory/2028-3-0x000007FEF51F3000-0x000007FEF51F4000-memory.dmp

Filesize
4KB

Download
memory/2028-4-0x000007FEF51F0000-0x000007FEF5BDC000-memory.dmp

Filesize
9.9MB

Download