discordrat | 74c8a489fd5f25c492911a489864cbfcec452f6fb58d30aa4d581a41cbcd8e09

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25-07-2024 12:53

Target

Client-built.exe
Size

78KB
MD5

cd4014c7eb128d92d9912e12d4d39a8a
SHA1

e7489ce5b32c002ef638bdeae884322ca1040aca
SHA256

74c8a489fd5f25c492911a489864cbfcec452f6fb58d30aa4d581a41cbcd8e09
SHA512

dbc1cf52e79cf3dc4d24d48bdc76a8e9c637539f3c5a93575990fa582ffd2940472c18d7679f8012b6ea40805b9a980dad66fb2f34a5be58dcb05a298844174f
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+vPIC:5Zv5PDwbjNrmAE+XIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI2MzQ3MTY1NDQ3MDY4NDY3Mg.GIArw-.EV9b3dUNyQHg6d4ETU34WCRPf5CRGszy_-3RTQ
server_id
1156550240124534844

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 904	2496	Client-built.exe	30
PID 2496 wrote to memory of 904	2496	Client-built.exe	30
PID 2496 wrote to memory of 904	2496	Client-built.exe	30

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2496 -s 596
  2⤵
  PID:904

memory/2496-2-0x000007FEF5C30000-0x000007FEF661C000-memory.dmp

Filesize
9.9MB

Download
memory/2496-1-0x000000013F8F0000-0x000000013F908000-memory.dmp

Filesize
96KB

Download
memory/2496-0-0x000007FEF5C33000-0x000007FEF5C34000-memory.dmp

Filesize
4KB

Download
memory/2496-3-0x000007FEF5C33000-0x000007FEF5C34000-memory.dmp

Filesize
4KB

Download
memory/2496-4-0x000007FEF5C30000-0x000007FEF661C000-memory.dmp

Filesize
9.9MB

Download