discordrat | 8fb0d1b94e2bd58cddd8bffd46e21b339e71d51864674a86734e6275be3c89a0

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07-07-2024 01:02

Target

Client-built.exe
Size

78KB
MD5

b7c719ce6dd4c79717aff2dbe0535ed4
SHA1

e6183c2f5188b500aa22271391c14112a7da8040
SHA256

8fb0d1b94e2bd58cddd8bffd46e21b339e71d51864674a86734e6275be3c89a0
SHA512

dd72636eea9212a377a5c0c822509c71db144513453157d6b91a8db5ecacd10309939ad7cd0f5fb6874f5b3594044095495fa671cd2a5bfe95cb99dd9c39cc13
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+EPIC:5Zv5PDwbjNrmAE+YIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI1OTMxMTUzNDI3NTAzOTIzMw.GmGDhH.EaIrMf7HuDdXx1VBH7gs5UOn2sZt13UuHvMLrU
server_id
1259311133618081806

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Client-built.exe

description	pid	process	target process
PID 2676 wrote to memory of 2760	2676	Client-built.exe	WerFault.exe
PID 2676 wrote to memory of 2760	2676	Client-built.exe	WerFault.exe
PID 2676 wrote to memory of 2760	2676	Client-built.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2676

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2676 -s 600
2⤵
PID:2760

memory/2676-0-0x000007FEF4C23000-0x000007FEF4C24000-memory.dmp

Filesize
4KB

Download
memory/2676-1-0x000000013FD30000-0x000000013FD48000-memory.dmp

Filesize
96KB

Download
memory/2676-2-0x000007FEF4C20000-0x000007FEF560C000-memory.dmp

Filesize
9.9MB

Download
memory/2676-3-0x000007FEF4C23000-0x000007FEF4C24000-memory.dmp

Filesize
4KB

Download
memory/2676-4-0x000007FEF4C20000-0x000007FEF560C000-memory.dmp

Filesize
9.9MB

Download