discordrat | b951272f47ced0c14aa6be5372daa3e89fff7b44dc5ae253c8166aeffe667a15

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08-07-2024 08:52

Target

Client-built.exe
Size

89KB
MD5

ef6d019f15f74d6ad839a9ba75318981
SHA1

1ebbe171a6cad7d3d2327987b465e6c956b7b439
SHA256

b951272f47ced0c14aa6be5372daa3e89fff7b44dc5ae253c8166aeffe667a15
SHA512

6078520ff4ea91b971421f4f434726b6f626d407d9dbc388bc830ee5defb14e3b40432b7ad248472a146567679ff43443250965d5f84777aa9b342cb93fac5c9
SSDEEP

1536:nE+2kB+5mjlB7OJ7nyfqgjOXT3UhqWkIod+K46MUL2UgbmNrt+fexCxoKV6+fcGH:Ed55mjDOJmfqgjOD3UhqpI4T4oLtgbm

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI1NTcyNzcxMzM5ODgyMDg2NQ.GY_3hS.g7WGHrqjV92f8bpx1SBQS0hKECEsHYsCTP5ByY
server_id
1255727160723767347

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	2956	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2956	AUDIODG.EXE
Token: 33	2956	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2956	AUDIODG.EXE

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Client-built.exe

description	pid	process	target process
PID 2112 wrote to memory of 1108	2112	Client-built.exe	WerFault.exe
PID 2112 wrote to memory of 1108	2112	Client-built.exe	WerFault.exe
PID 2112 wrote to memory of 1108	2112	Client-built.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2112

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2112 -s 596
2⤵
PID:1108

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x7c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2956

memory/2112-2-0x000007FEF5D90000-0x000007FEF677C000-memory.dmp

Filesize
9.9MB

Download
memory/2112-1-0x000000013F070000-0x000000013F08A000-memory.dmp

Filesize
104KB

Download
memory/2112-0-0x000007FEF5D93000-0x000007FEF5D94000-memory.dmp

Filesize
4KB

Download
memory/2112-3-0x000007FEF5D90000-0x000007FEF677C000-memory.dmp

Filesize
9.9MB

Download