discordrat | 98dd156638016b0abfb53a44dba4e8452b9b57bd0d9093c9995e88a9c6c7d750

Analysis

max time kernel
1560s
max time network
1563s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 23:22

Target

DoomedWorld.exe
Size

78KB
MD5

8121de3645a1421d72afa83c8791951c
SHA1

9654de88957f4995899bfbf5ab2eedbbe95be12f
SHA256

98dd156638016b0abfb53a44dba4e8452b9b57bd0d9093c9995e88a9c6c7d750
SHA512

d75f84fb3330105af2feaa98a8352ad68a473bce22e848fea99a9b6cd0818199d786d3955e6960730074c05c1df23b5ca664dcc22bf8bf9553a1cb07a78a49df
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+gPIC:5Zv5PDwbjNrmAE+EIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI1NzAyMzI2NzMzNjc0OTExMA.GRRCqL.-hOLG_NYwHg-QndfQvaNfpmA9h6WqvK4pkfIS8
server_id
1257024430513848503

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

DoomedWorld.exe

description	pid	process	target process
PID 2756 wrote to memory of 1124	2756	DoomedWorld.exe	WerFault.exe
PID 2756 wrote to memory of 1124	2756	DoomedWorld.exe	WerFault.exe
PID 2756 wrote to memory of 1124	2756	DoomedWorld.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\DoomedWorld.exe
"C:\Users\Admin\AppData\Local\Temp\DoomedWorld.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2756

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2756 -s 596
2⤵
PID:1124

memory/2756-0-0x000007FEF6053000-0x000007FEF6054000-memory.dmp

Filesize
4KB

Download
memory/2756-1-0x000000013F400000-0x000000013F418000-memory.dmp

Filesize
96KB

Download
memory/2756-2-0x000007FEF6050000-0x000007FEF6A3C000-memory.dmp

Filesize
9.9MB

Download
memory/2756-3-0x000007FEF6053000-0x000007FEF6054000-memory.dmp

Filesize
4KB

Download
memory/2756-4-0x000007FEF6050000-0x000007FEF6A3C000-memory.dmp

Filesize
9.9MB

Download