discordrat | f3fb40dafa45ac4395bea829b795e44e5b5721015e6f68d01046d023552205c7

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-07-2024 08:31

Target

f3fb40dafa45ac4395bea829b795e44e5b5721015e6f68d01046d023552205c7.exe
Size

78KB
MD5

705a3c902a119231a2a451ae45f41c24
SHA1

55f6e0eca51618ddafb64deb334b3ca65b46e609
SHA256

f3fb40dafa45ac4395bea829b795e44e5b5721015e6f68d01046d023552205c7
SHA512

6afceefea7dc88442246918a9b959b0237c4890c393b46ee47008d152a9f50af7d7d7fab44615bfbcfc896a9c7b46ffdee05cb37b9f217193088c895e586413b
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+nSPIC:5Zv5PDwbjNrmAE+neIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI0NzY5MDU1NzMxNzE4OTY4Mg.GyYj7a.-_zHa0DX8IUmeV5V7lgI2Zu9LJMJB_rP88vRLU
server_id
1247690557317189682

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

f3fb40dafa45ac4395bea829b795e44e5b5721015e6f68d01046d023552205c7.exe

description	pid	process	target process
PID 3024 wrote to memory of 3032	3024	f3fb40dafa45ac4395bea829b795e44e5b5721015e6f68d01046d023552205c7.exe	WerFault.exe
PID 3024 wrote to memory of 3032	3024	f3fb40dafa45ac4395bea829b795e44e5b5721015e6f68d01046d023552205c7.exe	WerFault.exe
PID 3024 wrote to memory of 3032	3024	f3fb40dafa45ac4395bea829b795e44e5b5721015e6f68d01046d023552205c7.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\f3fb40dafa45ac4395bea829b795e44e5b5721015e6f68d01046d023552205c7.exe
"C:\Users\Admin\AppData\Local\Temp\f3fb40dafa45ac4395bea829b795e44e5b5721015e6f68d01046d023552205c7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3024

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3024 -s 600
2⤵
PID:3032

memory/3024-0-0x000007FEF5343000-0x000007FEF5344000-memory.dmp

Filesize
4KB

Download
memory/3024-1-0x000000013FC30000-0x000000013FC48000-memory.dmp

Filesize
96KB

Download
memory/3024-2-0x000007FEF5340000-0x000007FEF5D2C000-memory.dmp

Filesize
9.9MB

Download
memory/3024-3-0x000007FEF5340000-0x000007FEF5D2C000-memory.dmp

Filesize
9.9MB

Download