discordrat | 064fae8bfdfbbd03cb8fcc4595ef64fbe150086e524e0bdc0c03f9318e7fca96

Analysis

max time kernel
105s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
11-08-2024 15:54

Target

Client-built.exe
Size

78KB
MD5

c56402aa71cbd79d6d6b88ce0f496b1c
SHA1

bc975d039ee9f1b3b94e7c13d3c0ba59a1571204
SHA256

064fae8bfdfbbd03cb8fcc4595ef64fbe150086e524e0bdc0c03f9318e7fca96
SHA512

62ff9a7ecd014d8d95a485a64808402f762518cb5aabd3e71485e94eff388d868253b7a9fc36aab4cfa301a36db71cdaf96085c819f57f024d5621a8607a0c0a
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+fPIC:5Zv5PDwbjNrmAE+nIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTAwNjIwODg2NTI0MDYxMjk4Ng.GBKh6L.m3Qaw6w3t6NUbjPUrUJ8Y_JgBdPHM_bBhT652s
server_id
1235244401433772182

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 1360	1748	Client-built.exe	29
PID 1748 wrote to memory of 1360	1748	Client-built.exe	29
PID 1748 wrote to memory of 1360	1748	Client-built.exe	29

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1748 -s 600
  2⤵
  PID:1360

memory/1748-0-0x000007FEF56E3000-0x000007FEF56E4000-memory.dmp

Filesize
4KB

Download
memory/1748-1-0x000000013F100000-0x000000013F118000-memory.dmp

Filesize
96KB

Download
memory/1748-2-0x000007FEF56E0000-0x000007FEF60CC000-memory.dmp

Filesize
9.9MB

Download
memory/1748-3-0x000007FEF56E3000-0x000007FEF56E4000-memory.dmp

Filesize
4KB

Download
memory/1748-4-0x000007FEF56E0000-0x000007FEF60CC000-memory.dmp

Filesize
9.9MB

Download