discordrat | 3459e35226cf145ac143580a6507888db3810e9c28da3b04e54808b5d1149253

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24-07-2024 03:27

Target

a9e093dbd1c972fd8e7bf96e65bb57f7.exe
Size

78KB
MD5

a9e093dbd1c972fd8e7bf96e65bb57f7
SHA1

39f199923cc2a30c28b71ec8eaebc9abe17fd761
SHA256

3459e35226cf145ac143580a6507888db3810e9c28da3b04e54808b5d1149253
SHA512

1f08ffc2a1492942841a32253cbe666b0427783bb19fad7c7eb57e3427bb6777ea8aa062beeb524f543ba17d8ef1b1992089850e4a368cff9143bbe3236987ed
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+/PIC:5Zv5PDwbjNrmAE+HIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI2NTA1NTY5NzQzMTY5MTMyNQ.GedQFI.I4snNL2g6u0HkYShXIMfQrgS7oHmpa18Xp3utM
server_id
1241810215675101325

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2492	1984	a9e093dbd1c972fd8e7bf96e65bb57f7.exe	31
PID 1984 wrote to memory of 2492	1984	a9e093dbd1c972fd8e7bf96e65bb57f7.exe	31
PID 1984 wrote to memory of 2492	1984	a9e093dbd1c972fd8e7bf96e65bb57f7.exe	31

C:\Users\Admin\AppData\Local\Temp\a9e093dbd1c972fd8e7bf96e65bb57f7.exe
"C:\Users\Admin\AppData\Local\Temp\a9e093dbd1c972fd8e7bf96e65bb57f7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1984 -s 596
  2⤵
  PID:2492

memory/1984-0-0x000007FEF5E13000-0x000007FEF5E14000-memory.dmp

Filesize
4KB

Download
memory/1984-1-0x000000013FF80000-0x000000013FF98000-memory.dmp

Filesize
96KB

Download
memory/1984-2-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Filesize
9.9MB

Download
memory/1984-3-0x000007FEF5E13000-0x000007FEF5E14000-memory.dmp

Filesize
4KB

Download
memory/1984-4-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Filesize
9.9MB

Download