discordrat | cd28a30e4e7970b5fe7e2d2ab0244a41ed3fed048904d671ce2db28de1a87529

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 13:24

Target

compiler.exe
Size

78KB
MD5

cc0c0d53ea855321b892e9d69ce09d1f
SHA1

604de3c919a7768f107e15c12c816ed11ea0146f
SHA256

cd28a30e4e7970b5fe7e2d2ab0244a41ed3fed048904d671ce2db28de1a87529
SHA512

58a7a3e9b374296d8898929a9c1806beb501e45c232efd11db1449583e8227b4a0511fc724d07be030baa640aa285ed7648ed1a328a40e47989b0d7673a4d609
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+SPIC:5Zv5PDwbjNrmAE+eIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI1MzY2NzkzMTcwMzc0MjQ3NA.Gw8dsn.LeG778rjIzDyfb3CK-K3udb1GPBgWlxFwh_VdU
server_id
1250682422434074634

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

compiler.exe

description	pid	process	target process
PID 2008 wrote to memory of 1996	2008	compiler.exe	WerFault.exe
PID 2008 wrote to memory of 1996	2008	compiler.exe	WerFault.exe
PID 2008 wrote to memory of 1996	2008	compiler.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\compiler.exe
"C:\Users\Admin\AppData\Local\Temp\compiler.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2008 -s 596
2⤵
PID:1996

memory/2008-0-0x000007FEF5763000-0x000007FEF5764000-memory.dmp

Filesize
4KB

Download
memory/2008-1-0x000000013F3E0000-0x000000013F3F8000-memory.dmp

Filesize
96KB

Download
memory/2008-2-0x000007FEF5760000-0x000007FEF614C000-memory.dmp

Filesize
9.9MB

Download
memory/2008-3-0x000007FEF5763000-0x000007FEF5764000-memory.dmp

Filesize
4KB

Download
memory/2008-4-0x000007FEF5760000-0x000007FEF614C000-memory.dmp

Filesize
9.9MB

Download