discordrat | 7a115e8e2a08dc79a6c5c44f70c73fadf94a2929dd979d3fe075c5d5c165c3be

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 18:45

Target

Client-built.exe
Size

78KB
MD5

e0c733b9b96700f34191ce9b4de022c7
SHA1

ccb67dc371b3ec3cac4da6c0c94579e204ae28d7
SHA256

7a115e8e2a08dc79a6c5c44f70c73fadf94a2929dd979d3fe075c5d5c165c3be
SHA512

0b63b5f321d8a3d8441578cf5c64376d1912c4eafce946a3a3f9fe4a4c0a2319a65fc424baa618955fcd43b9f88d11dbe3cfb591451bb3a92cb6755e08cf6c85
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+QPIC:5Zv5PDwbjNrmAE+UIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI2NjEwODMxNjM3NTk3Mzk3OQ.GL09hQ.Q7YqgeNtKFoxMQV9SscWFfX41Ca4P--315XiRI
server_id
1266108221232255026

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2208	2252	Client-built.exe	30
PID 2252 wrote to memory of 2208	2252	Client-built.exe	30
PID 2252 wrote to memory of 2208	2252	Client-built.exe	30

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2252 -s 596
  2⤵
  PID:2208

memory/2252-0-0x000007FEF6163000-0x000007FEF6164000-memory.dmp

Filesize
4KB

Download
memory/2252-1-0x000000013F470000-0x000000013F488000-memory.dmp

Filesize
96KB

Download
memory/2252-2-0x000007FEF6160000-0x000007FEF6B4C000-memory.dmp

Filesize
9.9MB

Download
memory/2252-3-0x000007FEF6163000-0x000007FEF6164000-memory.dmp

Filesize
4KB

Download
memory/2252-4-0x000007FEF6160000-0x000007FEF6B4C000-memory.dmp

Filesize
9.9MB

Download