discordrat | 1476253151800a7f9e7c39b61a25a2c107769212ed847083f8ac0d5ed49d8631

Analysis

max time kernel
132s
max time network
118s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
26-06-2024 17:47

Target

Client-built.exe
Size

78KB
MD5

a614ffb04f1b40d34e17ebe6958e43cd
SHA1

be32312b8b3d426cf3be1267aacc19dc7b332826
SHA256

1476253151800a7f9e7c39b61a25a2c107769212ed847083f8ac0d5ed49d8631
SHA512

59646dbd941e419943b82ce79c3c7444fbfe52d046f8adfaf25c8448a88b1b8c487252234db25cd3bb092e8721eb93f8bb8b8c9a8e8545e3fbc0081569d42f33
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+CPIC:5Zv5PDwbjNrmAE+uIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI1MzM5NTg3ODUxMzg2ODg1Mg.GrWkny.T42N-XPbZi5vXQ9yat9Y4l_0_1T1AkqFScCsFs
server_id
1250120108064378900

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Client-built.exe

description	pid	process	target process
PID 2436 wrote to memory of 1508	2436	Client-built.exe	WerFault.exe
PID 2436 wrote to memory of 1508	2436	Client-built.exe	WerFault.exe
PID 2436 wrote to memory of 1508	2436	Client-built.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2436

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2436 -s 600
2⤵
PID:1508

memory/2436-0-0x000007FEF59F3000-0x000007FEF59F4000-memory.dmp

Filesize
4KB

Download
memory/2436-1-0x000000013FE70000-0x000000013FE88000-memory.dmp

Filesize
96KB

Download
memory/2436-2-0x000007FEF59F0000-0x000007FEF63DC000-memory.dmp

Filesize
9.9MB

Download
memory/2436-3-0x000007FEF59F0000-0x000007FEF63DC000-memory.dmp

Filesize
9.9MB

Download
memory/2436-4-0x000007FEF59F0000-0x000007FEF63DC000-memory.dmp

Filesize
9.9MB

Download