discordrat | 52a484d4eb6425b35dac7a4bee0f11264cd2d1bffacde29598a09872524f6f20

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21-07-2024 15:16

Target

Client-built.exe
Size

78KB
MD5

2cc6927a1d5c3bde984f25a9b05007d5
SHA1

f33545547eee6336909ca073025c79e37da15b3b
SHA256

52a484d4eb6425b35dac7a4bee0f11264cd2d1bffacde29598a09872524f6f20
SHA512

b47c675ecb50f06415e72bc4d58c0825d506a68a6aeb5f42cd6850cbd78519a26bb455d56f593af166896e23b1389a6dec11452f4fd053839719b0eb4e5028e0
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+sPIC:5Zv5PDwbjNrmAE+AIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI2NDMwOTUxMDE4NTQyMjkyOQ.GLVpJN.ZW6wGqcoOoCF3NBCDepxAkI0KTDo4249u28_l8
server_id
1263515163827507343

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2508	1956	Client-built.exe	30
PID 1956 wrote to memory of 2508	1956	Client-built.exe	30
PID 1956 wrote to memory of 2508	1956	Client-built.exe	30

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1956 -s 600
  2⤵
  PID:2508

memory/1956-0-0x000007FEF5433000-0x000007FEF5434000-memory.dmp

Filesize
4KB

Download
memory/1956-1-0x000000013F910000-0x000000013F928000-memory.dmp

Filesize
96KB

Download
memory/1956-2-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

Filesize
9.9MB

Download
memory/1956-3-0x000007FEF5433000-0x000007FEF5434000-memory.dmp

Filesize
4KB

Download
memory/1956-4-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

Filesize
9.9MB

Download