discordrat | 19cfac8181f164ad29bd35d33c6389fa75fa7eea2066ce43b1e054e687b2fb34

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 05:29

Target

test3/Release/Discord rat.exe
Size

78KB
MD5

b26aba78d2501b23ed1a11b8c03bafdd
SHA1

116c76b9cf3cd5b3627ff001d8a648f9c517f0eb
SHA256

30e7b349618473efb9dff3dcb0f5f2663d492744582d2d58a92f68b6f52bdaa7
SHA512

31d9d189e126de48d7465acd44430c6fd320bbcda6d004937ef7fbfd33de5b0b012a2af024fd1d2a7628d99e139b333a4726d4cb566f688c5c721d96901da249
SSDEEP

1536:Rw7DiDxvncD/3dV83E3iP4k/D0NLF8CAtYB1n4NBm/b/JbETFWRl3J4ynA/qbGP6:RSDiDxvncD/3dV83E3iP4k/D0NLF8CAW

Score

10^/10

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Discord rat.exe

description	pid	process	target process
PID 2840 wrote to memory of 1684	2840	Discord rat.exe	WerFault.exe
PID 2840 wrote to memory of 1684	2840	Discord rat.exe	WerFault.exe
PID 2840 wrote to memory of 1684	2840	Discord rat.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\test3\Release\Discord rat.exe
"C:\Users\Admin\AppData\Local\Temp\test3\Release\Discord rat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2840

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2840 -s 604
2⤵
PID:1684

memory/2840-0-0x000007FEF5C23000-0x000007FEF5C24000-memory.dmp

Filesize
4KB

Download
memory/2840-1-0x000000013FF00000-0x000000013FF18000-memory.dmp

Filesize
96KB

Download
memory/2840-2-0x000007FEF5C20000-0x000007FEF660C000-memory.dmp

Filesize
9.9MB

Download
memory/2840-3-0x000007FEF5C23000-0x000007FEF5C24000-memory.dmp

Filesize
4KB

Download
memory/2840-4-0x000007FEF5C20000-0x000007FEF660C000-memory.dmp

Filesize
9.9MB

Download