discordrat | 5a0c51497d3ff11818340ffb4e10ab631fd74923a57e315c068b37f3e1ae3952

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09-08-2024 11:08

Target

5a0c51497d3ff11818340ffb4e10ab631fd74923a57e315c068b37f3e1ae3952.exe
Size

78KB
MD5

48b88393b5bea065a9dc213e1ca3a239
SHA1

7e587aef5d8a6988e02070f65f51710b1428f285
SHA256

5a0c51497d3ff11818340ffb4e10ab631fd74923a57e315c068b37f3e1ae3952
SHA512

cbe2414d965be615310f1c0421cf5a5fff1759c7344a6540253632835ea06039b119e60b9e5a53f6102f8b0acac1157931cfb612461ad2dd89025cc259ed8222
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V++PIC:5Zv5PDwbjNrmAE+6IC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTIwOTI0MDMxODQzNjcwNDI2Ng.GV3uqM.q_1_-iJbxvHtLV17uuNAyHtplk8OLHpbr8b8O8
server_id
1271422756163944468

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2684	2648	5a0c51497d3ff11818340ffb4e10ab631fd74923a57e315c068b37f3e1ae3952.exe	30
PID 2648 wrote to memory of 2684	2648	5a0c51497d3ff11818340ffb4e10ab631fd74923a57e315c068b37f3e1ae3952.exe	30
PID 2648 wrote to memory of 2684	2648	5a0c51497d3ff11818340ffb4e10ab631fd74923a57e315c068b37f3e1ae3952.exe	30

C:\Users\Admin\AppData\Local\Temp\5a0c51497d3ff11818340ffb4e10ab631fd74923a57e315c068b37f3e1ae3952.exe
"C:\Users\Admin\AppData\Local\Temp\5a0c51497d3ff11818340ffb4e10ab631fd74923a57e315c068b37f3e1ae3952.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2648 -s 600
  2⤵
  PID:2684

memory/2648-0-0x000007FEF5543000-0x000007FEF5544000-memory.dmp

Filesize
4KB

Download
memory/2648-1-0x000000013F500000-0x000000013F518000-memory.dmp

Filesize
96KB

Download
memory/2648-2-0x000007FEF5540000-0x000007FEF5F2C000-memory.dmp

Filesize
9.9MB

Download
memory/2648-3-0x000007FEF5543000-0x000007FEF5544000-memory.dmp

Filesize
4KB

Download
memory/2648-4-0x000007FEF5540000-0x000007FEF5F2C000-memory.dmp

Filesize
9.9MB

Download