discordrat | 99a41fe49b630e376a51ccb96b0c544c52dc8cb7810c3ea245feb2b992d17156

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 17:40

Target

Client-built.exe
Size

78KB
MD5

ecb4d391860974bf98f86a0cc711dc9c
SHA1

66f05900f2e3ca855bc1bdca3c63105b0f459da2
SHA256

99a41fe49b630e376a51ccb96b0c544c52dc8cb7810c3ea245feb2b992d17156
SHA512

4de73bb983c343c4379a5c3a317c3878305848506c120940f239a5252ba891e8256a0104e470e0e638d0bd54d99b2b5c68021a2ec3b9e13479e9ba8977c116ec
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+bPIC:5Zv5PDwbjNrmAE+TIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI1MTk1MTY5NzUxMzY3NjkwMQ.GiMHbn.X9GDqCvrOuKnpbl_UBD8D1ViJZrODoGUzm6hFU
server_id
1251916764929982485

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Client-built.exe

description	pid	process	target process
PID 2924 wrote to memory of 2148	2924	Client-built.exe	WerFault.exe
PID 2924 wrote to memory of 2148	2924	Client-built.exe	WerFault.exe
PID 2924 wrote to memory of 2148	2924	Client-built.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2924

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2924 -s 596
2⤵
PID:2148

memory/2924-0-0x000007FEF5CE3000-0x000007FEF5CE4000-memory.dmp

Filesize
4KB

Download
memory/2924-1-0x000000013FD70000-0x000000013FD88000-memory.dmp

Filesize
96KB

Download
memory/2924-2-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmp

Filesize
9.9MB

Download
memory/2924-3-0x000007FEF5CE3000-0x000007FEF5CE4000-memory.dmp

Filesize
4KB

Download
memory/2924-4-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmp

Filesize
9.9MB

Download