discordrat | bb87bfd0200477dc0a9856a2af72aa6220432b72d39980ca4ed087d6a6765298

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
02-08-2024 18:35

Target

Client-built.exe
Size

78KB
MD5

c49f1bfb399f94a4dfe7d942f72bdfa3
SHA1

cad8082d44ce665d5f029c76c4707d7af94a74b8
SHA256

bb87bfd0200477dc0a9856a2af72aa6220432b72d39980ca4ed087d6a6765298
SHA512

b98e2f8878569cd39ce20898b13b5ef92f105df90f615c085d562017fb5345f82cd12003694ed154c747fb50ab0dcb59413e804f5eaf47bb8060625529ae7fb1
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+TPIC:5Zv5PDwbjNrmAE+LIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTIwMjQwMjY2MDIzODQ5OTk0MA.GPrras.mO57WBqUXyg3QZiMPr_EwuwiZ1L6OQ1MgANBWU
server_id
1133835494753587300

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1660	2080	Client-built.exe	31
PID 2080 wrote to memory of 1660	2080	Client-built.exe	31
PID 2080 wrote to memory of 1660	2080	Client-built.exe	31

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2080 -s 596
  2⤵
  PID:1660

memory/2080-0-0x000007FEF5EF3000-0x000007FEF5EF4000-memory.dmp

Filesize
4KB

Download
memory/2080-1-0x000000013F440000-0x000000013F458000-memory.dmp

Filesize
96KB

Download
memory/2080-2-0x000007FEF5EF0000-0x000007FEF68DC000-memory.dmp

Filesize
9.9MB

Download
memory/2080-3-0x000007FEF5EF3000-0x000007FEF5EF4000-memory.dmp

Filesize
4KB

Download
memory/2080-4-0x000007FEF5EF0000-0x000007FEF68DC000-memory.dmp

Filesize
9.9MB

Download