discordrat | 5a0c51497d3ff11818340ffb4e10ab631fd74923a57e315c068b37f3e1ae3952

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/08/2024, 11:02

Target

5a0c51497d3ff11818340ffb4e10ab631fd74923a57e315c068b37f3e1ae3952.exe
Size

78KB
MD5

48b88393b5bea065a9dc213e1ca3a239
SHA1

7e587aef5d8a6988e02070f65f51710b1428f285
SHA256

5a0c51497d3ff11818340ffb4e10ab631fd74923a57e315c068b37f3e1ae3952
SHA512

cbe2414d965be615310f1c0421cf5a5fff1759c7344a6540253632835ea06039b119e60b9e5a53f6102f8b0acac1157931cfb612461ad2dd89025cc259ed8222
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V++PIC:5Zv5PDwbjNrmAE+6IC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTIwOTI0MDMxODQzNjcwNDI2Ng.GV3uqM.q_1_-iJbxvHtLV17uuNAyHtplk8OLHpbr8b8O8
server_id
1271422756163944468

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2452	2676	5a0c51497d3ff11818340ffb4e10ab631fd74923a57e315c068b37f3e1ae3952.exe	28
PID 2676 wrote to memory of 2452	2676	5a0c51497d3ff11818340ffb4e10ab631fd74923a57e315c068b37f3e1ae3952.exe	28
PID 2676 wrote to memory of 2452	2676	5a0c51497d3ff11818340ffb4e10ab631fd74923a57e315c068b37f3e1ae3952.exe	28

C:\Users\Admin\AppData\Local\Temp\5a0c51497d3ff11818340ffb4e10ab631fd74923a57e315c068b37f3e1ae3952.exe
"C:\Users\Admin\AppData\Local\Temp\5a0c51497d3ff11818340ffb4e10ab631fd74923a57e315c068b37f3e1ae3952.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2676 -s 600
  2⤵
  PID:2452

memory/2676-0-0x000007FEF5833000-0x000007FEF5834000-memory.dmp

Filesize
4KB

Download
memory/2676-1-0x000000013F960000-0x000000013F978000-memory.dmp

Filesize
96KB

Download
memory/2676-2-0x000007FEF5830000-0x000007FEF621C000-memory.dmp

Filesize
9.9MB

Download
memory/2676-3-0x000007FEF5833000-0x000007FEF5834000-memory.dmp

Filesize
4KB

Download
memory/2676-4-0x000007FEF5830000-0x000007FEF621C000-memory.dmp

Filesize
9.9MB

Download