discordrat | 292f3a442b476c28afc3249f743025dec25bf27d8b17fe77a981eecf0855de13

Analysis

max time kernel
839s
max time network
841s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 17:22

Target

roblox-player.exe
Size

78KB
MD5

1e45a9dde0fa43462d3132a6409d6bd3
SHA1

9da3717811e4fbd3f5a8a34f5e6a7ed18e20b22a
SHA256

292f3a442b476c28afc3249f743025dec25bf27d8b17fe77a981eecf0855de13
SHA512

7ad3b6b5cfb79ac02f8c026026ca442f82ee9fec3cf619b32d72ad8ae406a797364b84e4dffaea54f48d3abe3c81b7e109e998330cb734912431e1e666718c4a
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+jPIC:5Zv5PDwbjNrmAE+7IC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTE5ODIzNjEyMDA3MzM3MTc1OA.G8u0Ka.A4SAtH9lkH8LkHGGBTIXVQMB7VUu6Xrbs9X1kk
server_id
1237627992709009478

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2972	1612	roblox-player.exe	28
PID 1612 wrote to memory of 2972	1612	roblox-player.exe	28
PID 1612 wrote to memory of 2972	1612	roblox-player.exe	28

C:\Users\Admin\AppData\Local\Temp\roblox-player.exe
"C:\Users\Admin\AppData\Local\Temp\roblox-player.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1612 -s 596
  2⤵
  PID:2972

memory/1612-0-0x000007FEF55C3000-0x000007FEF55C4000-memory.dmp

Filesize
4KB

Download
memory/1612-1-0x000000013FC90000-0x000000013FCA8000-memory.dmp

Filesize
96KB

Download
memory/1612-2-0x000007FEF55C0000-0x000007FEF5FAC000-memory.dmp

Filesize
9.9MB

Download
memory/1612-3-0x000007FEF55C3000-0x000007FEF55C4000-memory.dmp

Filesize
4KB

Download
memory/1612-4-0x000007FEF55C0000-0x000007FEF5FAC000-memory.dmp

Filesize
9.9MB

Download