discordrat | 540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-06-2024 06:39

Target

540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe
Size

78KB
MD5

a2da8356ef064960ab8dd09372627a58
SHA1

2edb364315b7f1a5ee652e015a1316c6640d2d2b
SHA256

540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e
SHA512

9e4770e0d3a9404ea78d532b08e4b70c1be77fcd5797601fb17c18e45b991c10407c595a52ca361affd6bffeb476cdbcba184dd07142f10d74f23c4f357b6ace
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+KPIC:5Zv5PDwbjNrmAE+WIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI0NjMwMTQ1MjQwNjc1MTI0Mg.GoEe4D.Ukxxcg2g6oiBh3IEoYa6C5FTUz1iU45J3sp1bU
server_id
1246300545325727776

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe

description	pid	process	target process
PID 2660 wrote to memory of 2504	2660	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe	WerFault.exe
PID 2660 wrote to memory of 2504	2660	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe	WerFault.exe
PID 2660 wrote to memory of 2504	2660	540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe
"C:\Users\Admin\AppData\Local\Temp\540611034c0489b1b4e2822b692bff7167369ceaea4bfd334aeaa33e0ae6ae6e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2660

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2660 -s 600
2⤵
PID:2504

memory/2660-0-0x000007FEF5813000-0x000007FEF5814000-memory.dmp

Filesize
4KB

Download
memory/2660-1-0x000000013FF80000-0x000000013FF98000-memory.dmp

Filesize
96KB

Download
memory/2660-2-0x000007FEF5810000-0x000007FEF61FC000-memory.dmp

Filesize
9.9MB

Download
memory/2660-3-0x000007FEF5813000-0x000007FEF5814000-memory.dmp

Filesize
4KB

Download
memory/2660-4-0x000007FEF5810000-0x000007FEF61FC000-memory.dmp

Filesize
9.9MB

Download