discordrat | 74b6089379acff9803a37c3b5e8bc86c5877a319c4ced5a714ff9c9c63905188

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 14:34

Target

cdumper/compiler.exe
Size

78KB
MD5

cc0c0d53ea855321b892e9d69ce09d1f
SHA1

604de3c919a7768f107e15c12c816ed11ea0146f
SHA256

cd28a30e4e7970b5fe7e2d2ab0244a41ed3fed048904d671ce2db28de1a87529
SHA512

58a7a3e9b374296d8898929a9c1806beb501e45c232efd11db1449583e8227b4a0511fc724d07be030baa640aa285ed7648ed1a328a40e47989b0d7673a4d609
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+SPIC:5Zv5PDwbjNrmAE+eIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI1MzY2NzkzMTcwMzc0MjQ3NA.Gw8dsn.LeG778rjIzDyfb3CK-K3udb1GPBgWlxFwh_VdU
server_id
1250682422434074634

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2748	2872	compiler.exe	28
PID 2872 wrote to memory of 2748	2872	compiler.exe	28
PID 2872 wrote to memory of 2748	2872	compiler.exe	28

C:\Users\Admin\AppData\Local\Temp\cdumper\compiler.exe
"C:\Users\Admin\AppData\Local\Temp\cdumper\compiler.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2872 -s 596
  2⤵
  PID:2748

memory/2872-0-0x000007FEF5203000-0x000007FEF5204000-memory.dmp

Filesize
4KB

Download
memory/2872-1-0x000000013F6D0000-0x000000013F6E8000-memory.dmp

Filesize
96KB

Download
memory/2872-2-0x000007FEF5200000-0x000007FEF5BEC000-memory.dmp

Filesize
9.9MB

Download
memory/2872-3-0x000007FEF5203000-0x000007FEF5204000-memory.dmp

Filesize
4KB

Download
memory/2872-4-0x000007FEF5200000-0x000007FEF5BEC000-memory.dmp

Filesize
9.9MB

Download