discordrat | 102a3644329b422f1d0269f1ab5b76f704156337bb26891dca9c1fc7aa977583

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
12-06-2024 07:23

Target

Client-built.exe
Size

78KB
MD5

e2421b4a38296defc34c169797c9b854
SHA1

4ffa782ab9cfe8257bf0d8a6e04014d77fb30b6f
SHA256

102a3644329b422f1d0269f1ab5b76f704156337bb26891dca9c1fc7aa977583
SHA512

93c1394cf5a4056f67fb2219f2af1a2bc4f4a0cebccb0c43975374c59d5db70e8f39b1ac04ae8746ea88a4d85c0045db8ba2ec5019cb860d6616ea0e45ee52e6
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+4PIC:5Zv5PDwbjNrmAE+cIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTE4NjMwMDIxMjUyMDY5Mzc2MA.GTBmJ7.QTY2s7MMBf2C8Dro6wBnMQp8fyi7o3cv1ju7-s
server_id
1250344666331615325

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Client-built.exe

description	pid	process	target process
PID 2804 wrote to memory of 2296	2804	Client-built.exe	WerFault.exe
PID 2804 wrote to memory of 2296	2804	Client-built.exe	WerFault.exe
PID 2804 wrote to memory of 2296	2804	Client-built.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2804

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2804 -s 596
2⤵
PID:2296

memory/2804-0-0x000007FEF4D53000-0x000007FEF4D54000-memory.dmp

Filesize
4KB

Download
memory/2804-1-0x000000013F450000-0x000000013F468000-memory.dmp

Filesize
96KB

Download
memory/2804-2-0x000007FEF4D50000-0x000007FEF573C000-memory.dmp

Filesize
9.9MB

Download
memory/2804-3-0x000007FEF4D53000-0x000007FEF4D54000-memory.dmp

Filesize
4KB

Download
memory/2804-4-0x000007FEF4D50000-0x000007FEF573C000-memory.dmp

Filesize
9.9MB

Download