discordrat | a776251598a04f95638c0dcd878a01bec871043aea05e59f2b43aa7013f3549b

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 16:18

Target

Client-built.exe
Size

78KB
MD5

61fdddfef03616cc0bb43d2534d216ba
SHA1

ad9a340edc40a4c30a757b54a1817db7544d61fd
SHA256

a776251598a04f95638c0dcd878a01bec871043aea05e59f2b43aa7013f3549b
SHA512

91a6c6986e8488d592b8621389eb95abf7dbfd2789d4cfd1343c4ae0dfc1502b8319fa24385f8e042ceb306e0e3141d5dd63ca5274de1b2918e40b9b5de6694b
SSDEEP

1536:K2WjO8XeEXF15P7v88wbjNrfxCXhRoKV6+V+PPIC:KZb5PDwbjNrmAE+3IC

Score

10^/10

Family

discordrat

Attributes

discord_token
https://discord.com/api/webhooks/1268956443017478144/qXtQPqPq0lNYWEP6kL-SgCUSDgKk0-oAw47o-nRhBdJiBKnPwUEI7GkpOsrdi8-7DIoj
server_id
1268956309605060639

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2692	2348	Client-built.exe	30
PID 2348 wrote to memory of 2692	2348	Client-built.exe	30
PID 2348 wrote to memory of 2692	2348	Client-built.exe	30

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2348 -s 596
  2⤵
  PID:2692

memory/2348-0-0x000007FEF62C3000-0x000007FEF62C4000-memory.dmp

Filesize
4KB

Download
memory/2348-1-0x000000013F180000-0x000000013F198000-memory.dmp

Filesize
96KB

Download
memory/2348-2-0x000007FEF62C0000-0x000007FEF6CAC000-memory.dmp

Filesize
9.9MB

Download
memory/2348-3-0x000007FEF62C3000-0x000007FEF62C4000-memory.dmp

Filesize
4KB

Download
memory/2348-4-0x000007FEF62C0000-0x000007FEF6CAC000-memory.dmp

Filesize
9.9MB

Download