discordrat | 844881f2b8a8f0073ddbdd6752a3f7a453ea8d99c34bc672cf050aa7e59abe5c

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 23:49

Target

844881f2b8a8f0073ddbdd6752a3f7a453ea8d99c34bc672cf050aa7e59abe5c.exe
Size

78KB
MD5

9eb52ecd2ebee534d94599da4bd46c04
SHA1

b8ab0f5b7150bec75e415c93b17e2c4416fd6be6
SHA256

844881f2b8a8f0073ddbdd6752a3f7a453ea8d99c34bc672cf050aa7e59abe5c
SHA512

3b144c552f502e32e3fb80434325003e7166a54cd49b6e92a14ce613e997ea8fe3f5c1ac5ae1cc1e7e6a2b89b9ffb3c666ab50ae15600f001ae23e85a4fdd9a3
SSDEEP

1536:K2WjO8XeEXF15P7v88wbjNrfxCXhRoKV6+V+BPIC:KZb5PDwbjNrmAE+RIC

Score

10^/10

Family

discordrat

Attributes

discord_token
https://discord.com/api/webhooks/1257820709976277022/ZKUIwRoOmFL26xJdo5bOvsIHc6sf8Aqh56lsJZeqf-0B2oOIF8YZT_m2Z518ZY6qCm_-
server_id
1257819778219900989

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

844881f2b8a8f0073ddbdd6752a3f7a453ea8d99c34bc672cf050aa7e59abe5c.exe

description	pid	process	target process
PID 2544 wrote to memory of 3044	2544	844881f2b8a8f0073ddbdd6752a3f7a453ea8d99c34bc672cf050aa7e59abe5c.exe	WerFault.exe
PID 2544 wrote to memory of 3044	2544	844881f2b8a8f0073ddbdd6752a3f7a453ea8d99c34bc672cf050aa7e59abe5c.exe	WerFault.exe
PID 2544 wrote to memory of 3044	2544	844881f2b8a8f0073ddbdd6752a3f7a453ea8d99c34bc672cf050aa7e59abe5c.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\844881f2b8a8f0073ddbdd6752a3f7a453ea8d99c34bc672cf050aa7e59abe5c.exe
"C:\Users\Admin\AppData\Local\Temp\844881f2b8a8f0073ddbdd6752a3f7a453ea8d99c34bc672cf050aa7e59abe5c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2544

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2544 -s 600
2⤵
PID:3044

memory/2544-0-0x000007FEF57A3000-0x000007FEF57A4000-memory.dmp

Filesize
4KB

Download
memory/2544-1-0x000000013F520000-0x000000013F538000-memory.dmp

Filesize
96KB

Download
memory/2544-2-0x000007FEF57A0000-0x000007FEF618C000-memory.dmp

Filesize
9.9MB

Download
memory/2544-3-0x000007FEF57A3000-0x000007FEF57A4000-memory.dmp

Filesize
4KB

Download
memory/2544-4-0x000007FEF57A0000-0x000007FEF618C000-memory.dmp

Filesize
9.9MB

Download