discordrat | 8205cae8d9248b378667981ac5e86d3969d9aaf6bd0bdeb069c6ab1e67c304eb

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
05-07-2024 21:29

Target

8205cae8d9248b378667981ac5e86d3969d9aaf6bd0bdeb069c6ab1e67c304eb.exe
Size

78KB
MD5

62b838eaddd3d7362dbef4a2c069aab7
SHA1

dde6f70ab18ea8e519681abc3aaacec36860016b
SHA256

8205cae8d9248b378667981ac5e86d3969d9aaf6bd0bdeb069c6ab1e67c304eb
SHA512

908d4ca659b3754cd95c81913ce4f1364672df33a32f4265483428a4966f32892b302bfdfd00a2e6d6d891c295e0abc1c23f00212308d3490dccefa777352a80
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+tPIC:5Zv5PDwbjNrmAE+9IC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI1ODg4ODg2MzgxNjg4MDE5MA.GdDEsv.CHlhaZYA9oKA2qnxLBvkKeewJ0GmS5-g775ytQ
server_id
1256282170994196593

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

8205cae8d9248b378667981ac5e86d3969d9aaf6bd0bdeb069c6ab1e67c304eb.exe

description	pid	process	target process
PID 2028 wrote to memory of 2788	2028	8205cae8d9248b378667981ac5e86d3969d9aaf6bd0bdeb069c6ab1e67c304eb.exe	WerFault.exe
PID 2028 wrote to memory of 2788	2028	8205cae8d9248b378667981ac5e86d3969d9aaf6bd0bdeb069c6ab1e67c304eb.exe	WerFault.exe
PID 2028 wrote to memory of 2788	2028	8205cae8d9248b378667981ac5e86d3969d9aaf6bd0bdeb069c6ab1e67c304eb.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\8205cae8d9248b378667981ac5e86d3969d9aaf6bd0bdeb069c6ab1e67c304eb.exe
"C:\Users\Admin\AppData\Local\Temp\8205cae8d9248b378667981ac5e86d3969d9aaf6bd0bdeb069c6ab1e67c304eb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2028 -s 596
2⤵
PID:2788

memory/2028-0-0x000007FEF5BB3000-0x000007FEF5BB4000-memory.dmp

Filesize
4KB

Download
memory/2028-1-0x000000013F2C0000-0x000000013F2D8000-memory.dmp

Filesize
96KB

Download
memory/2028-2-0x000007FEF5BB0000-0x000007FEF659C000-memory.dmp

Filesize
9.9MB

Download
memory/2028-3-0x000007FEF5BB3000-0x000007FEF5BB4000-memory.dmp

Filesize
4KB

Download