discordrat | a776251598a04f95638c0dcd878a01bec871043aea05e59f2b43aa7013f3549b

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
04-08-2024 01:38

Target

a776251598a04f95638c0dcd878a01bec871043aea05e59f2b43aa7013f3549b.exe
Size

78KB
MD5

61fdddfef03616cc0bb43d2534d216ba
SHA1

ad9a340edc40a4c30a757b54a1817db7544d61fd
SHA256

a776251598a04f95638c0dcd878a01bec871043aea05e59f2b43aa7013f3549b
SHA512

91a6c6986e8488d592b8621389eb95abf7dbfd2789d4cfd1343c4ae0dfc1502b8319fa24385f8e042ceb306e0e3141d5dd63ca5274de1b2918e40b9b5de6694b
SSDEEP

1536:K2WjO8XeEXF15P7v88wbjNrfxCXhRoKV6+V+PPIC:KZb5PDwbjNrmAE+3IC

Score

10^/10

Family

discordrat

Attributes

discord_token
https://discord.com/api/webhooks/1268956443017478144/qXtQPqPq0lNYWEP6kL-SgCUSDgKk0-oAw47o-nRhBdJiBKnPwUEI7GkpOsrdi8-7DIoj
server_id
1268956309605060639

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2820	2480	a776251598a04f95638c0dcd878a01bec871043aea05e59f2b43aa7013f3549b.exe	30
PID 2480 wrote to memory of 2820	2480	a776251598a04f95638c0dcd878a01bec871043aea05e59f2b43aa7013f3549b.exe	30
PID 2480 wrote to memory of 2820	2480	a776251598a04f95638c0dcd878a01bec871043aea05e59f2b43aa7013f3549b.exe	30

C:\Users\Admin\AppData\Local\Temp\a776251598a04f95638c0dcd878a01bec871043aea05e59f2b43aa7013f3549b.exe
"C:\Users\Admin\AppData\Local\Temp\a776251598a04f95638c0dcd878a01bec871043aea05e59f2b43aa7013f3549b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2480 -s 600
  2⤵
  PID:2820

memory/2480-0-0x000007FEF5E43000-0x000007FEF5E44000-memory.dmp

Filesize
4KB

Download
memory/2480-1-0x000000013F6D0000-0x000000013F6E8000-memory.dmp

Filesize
96KB

Download
memory/2480-2-0x000007FEF5E40000-0x000007FEF682C000-memory.dmp

Filesize
9.9MB

Download
memory/2480-3-0x000007FEF5E43000-0x000007FEF5E44000-memory.dmp

Filesize
4KB

Download
memory/2480-4-0x000007FEF5E40000-0x000007FEF682C000-memory.dmp

Filesize
9.9MB

Download