discordrat | 1a44ce70ba73de7159f78b7775a588f97657e1c991bc98c1394d5c0075994ea9

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 04:27

Target

Client-built.exe
Size

78KB
MD5

debff807992d6ab1c4d7ce874cbe5c76
SHA1

aa0994bb764049500dd24dc80016712b23fb604b
SHA256

73cffd144f64cb6db1760979226341a2672a1c423acad623665abc20f2b497fa
SHA512

2f620659102d4f1fd065cc857fe2ca25c0ba6f3fc3a9834581a3d9c3b4628191e8a18f08c502e42e4dee98e09efc755a5154e96059a6100446a89c66ebb2e5bb
SSDEEP

1536:WIWOBaZ84c6gEz5De2FzNDnghTAsKFbOZGdndxRKDIZ8Ud0DGMpbDNr1+uexCxoK:WIWOBaZ84c6gEz5De2FzNDnghTdWd7Kf

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI1NjA3MjI4MTE3NjkzMjQwMg.GxD9m_.zzsnEGguqBxqJmCsGwZDpT0jW55Z5MKiEbx3N8
server_id
1256072040117698732

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 2216	1744	Client-built.exe	28
PID 1744 wrote to memory of 2216	1744	Client-built.exe	28
PID 1744 wrote to memory of 2216	1744	Client-built.exe	28

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1744 -s 600
  2⤵
  PID:2216

memory/1744-0-0x000007FEF5553000-0x000007FEF5554000-memory.dmp

Filesize
4KB

Download
memory/1744-1-0x000000013F770000-0x000000013F788000-memory.dmp

Filesize
96KB

Download
memory/1744-2-0x000007FEF5550000-0x000007FEF5F3C000-memory.dmp

Filesize
9.9MB

Download
memory/1744-3-0x000007FEF5553000-0x000007FEF5554000-memory.dmp

Filesize
4KB

Download
memory/1744-4-0x000007FEF5550000-0x000007FEF5F3C000-memory.dmp

Filesize
9.9MB

Download
memory/1744-5-0x000007FEF5550000-0x000007FEF5F3C000-memory.dmp

Filesize
9.9MB

Download