discordrat | e0c19df68387d0abf5057a4b160061c447c396f426c2095da6e7bb05882580e0

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
03-08-2024 16:21

Target

Spoofer.exe
Size

78KB
MD5

fc08a46e1d5ccd8f2f4405764579e96d
SHA1

500dc596fc1c7d812805883fa99564ed501c260c
SHA256

e0c19df68387d0abf5057a4b160061c447c396f426c2095da6e7bb05882580e0
SHA512

b783217687adc0d5ee1b180e94bbe8ed3f6fd17f9726779201ac7b68a2a4cdd1293595c6c68fdf3b3bfa757c93db61d158a7b820e43429c052a3d7a03e5ca592
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+DPIC:5Zv5PDwbjNrmAE+bIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI2OTMyNjMyMjU2NDQ2NDcyMA.Gu6MeW.9sR1DdBFtf43caLzgKfKK2XA_VZxEuQCEc5QyA
server_id
1269151973408641135

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 2888	2712	Spoofer.exe	30
PID 2712 wrote to memory of 2888	2712	Spoofer.exe	30
PID 2712 wrote to memory of 2888	2712	Spoofer.exe	30

C:\Users\Admin\AppData\Local\Temp\Spoofer.exe
"C:\Users\Admin\AppData\Local\Temp\Spoofer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2712 -s 600
  2⤵
  PID:2888

memory/2712-0-0x000007FEF5703000-0x000007FEF5704000-memory.dmp

Filesize
4KB

Download
memory/2712-1-0x000000013F950000-0x000000013F968000-memory.dmp

Filesize
96KB

Download
memory/2712-2-0x000007FEF5700000-0x000007FEF60EC000-memory.dmp

Filesize
9.9MB

Download
memory/2712-3-0x000007FEF5703000-0x000007FEF5704000-memory.dmp

Filesize
4KB

Download
memory/2712-4-0x000007FEF5700000-0x000007FEF60EC000-memory.dmp

Filesize
9.9MB

Download
memory/2712-5-0x000007FEF5700000-0x000007FEF60EC000-memory.dmp

Filesize
9.9MB

Download