discordrat | 19cfac8181f164ad29bd35d33c6389fa75fa7eea2066ce43b1e054e687b2fb34

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 05:34

Target

test3/Release/Discord rat.exe
Size

78KB
MD5

b26aba78d2501b23ed1a11b8c03bafdd
SHA1

116c76b9cf3cd5b3627ff001d8a648f9c517f0eb
SHA256

30e7b349618473efb9dff3dcb0f5f2663d492744582d2d58a92f68b6f52bdaa7
SHA512

31d9d189e126de48d7465acd44430c6fd320bbcda6d004937ef7fbfd33de5b0b012a2af024fd1d2a7628d99e139b333a4726d4cb566f688c5c721d96901da249
SSDEEP

1536:Rw7DiDxvncD/3dV83E3iP4k/D0NLF8CAtYB1n4NBm/b/JbETFWRl3J4ynA/qbGP6:RSDiDxvncD/3dV83E3iP4k/D0NLF8CAW

Score

10^/10

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2788	2924	Discord rat.exe	28
PID 2924 wrote to memory of 2788	2924	Discord rat.exe	28
PID 2924 wrote to memory of 2788	2924	Discord rat.exe	28

C:\Users\Admin\AppData\Local\Temp\test3\Release\Discord rat.exe
"C:\Users\Admin\AppData\Local\Temp\test3\Release\Discord rat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2924 -s 608
  2⤵
  PID:2788

memory/2924-0-0x000007FEF59E3000-0x000007FEF59E4000-memory.dmp

Filesize
4KB

Download
memory/2924-1-0x000000013FBA0000-0x000000013FBB8000-memory.dmp

Filesize
96KB

Download
memory/2924-2-0x000007FEF59E0000-0x000007FEF63CC000-memory.dmp

Filesize
9.9MB

Download
memory/2924-3-0x000007FEF59E3000-0x000007FEF59E4000-memory.dmp

Filesize
4KB

Download
memory/2924-4-0x000007FEF59E0000-0x000007FEF63CC000-memory.dmp

Filesize
9.9MB

Download