discordrat | 0ab02c70858b3e052b057884b62178a31310d250ee05556c01d6d8e7e0fb7fc4

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 02:53

Target

0ab02c70858b3e052b057884b62178a31310d250ee05556c01d6d8e7e0fb7fc4.exe
Size

79KB
MD5

40ea21b9f0767376311d4919d07f7ab8
SHA1

ac92cdbaae2cfe94ac5da19a25789972b2e8ea95
SHA256

0ab02c70858b3e052b057884b62178a31310d250ee05556c01d6d8e7e0fb7fc4
SHA512

abf1200edd4f67ac227ea55e8698341024c6d9416385f41627c45885ff72ceb71532007a86d1d49cd7b60a8f7cd4a42777c9866555de59255aa201865da3db6c
SSDEEP

1536:22WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+iPI2:2Zv5PDwbjNrmAE+OI2

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI1NjkxNTA1ODEzOTcyOTkyMA.GgcvFH.ZZtWziWR04JaiPJgPsf437j8uiy-5kqu0pM8H4
server_id
1256913520704884807

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2324	1684	0ab02c70858b3e052b057884b62178a31310d250ee05556c01d6d8e7e0fb7fc4.exe	28
PID 1684 wrote to memory of 2324	1684	0ab02c70858b3e052b057884b62178a31310d250ee05556c01d6d8e7e0fb7fc4.exe	28
PID 1684 wrote to memory of 2324	1684	0ab02c70858b3e052b057884b62178a31310d250ee05556c01d6d8e7e0fb7fc4.exe	28

C:\Users\Admin\AppData\Local\Temp\0ab02c70858b3e052b057884b62178a31310d250ee05556c01d6d8e7e0fb7fc4.exe
"C:\Users\Admin\AppData\Local\Temp\0ab02c70858b3e052b057884b62178a31310d250ee05556c01d6d8e7e0fb7fc4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1684 -s 596
  2⤵
  PID:2324

memory/1684-0-0x000007FEF5FA3000-0x000007FEF5FA4000-memory.dmp

Filesize
4KB

Download
memory/1684-1-0x000000013F0D0000-0x000000013F0E8000-memory.dmp

Filesize
96KB

Download
memory/1684-2-0x000007FEF5FA0000-0x000007FEF698C000-memory.dmp

Filesize
9.9MB

Download
memory/1684-3-0x000007FEF5FA3000-0x000007FEF5FA4000-memory.dmp

Filesize
4KB

Download
memory/1684-4-0x000007FEF5FA0000-0x000007FEF698C000-memory.dmp

Filesize
9.9MB

Download