discordrat | ddbdfe227d8394d50c28c4b02c39033c4d5d1962fbd1342a5ca5f236e9671619

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
15/08/2024, 01:54

Target
Client-built.exe
Size 78KB
Sample240815-cble2stelj
SHA256 ddbdfe227d8394d50c28c4b02c39033c4d5d1962fbd1342a5ca5f236e9671619
MD5 7d921a8a96e652d5264847bf6645f61c
SHA1 0ef41f617e00919d102098a7c82750f6e90d9b80
SHA512 ac86edaf87b61f0f5b6bf3dc2a70150b43a3e5a758ee4e45162c27491b0ba02f01203446af87666d7c2346169e5445e88027cffd8fcfa64543730078d8c7aed0
SSDEEP 1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+FPIC:5Zv5PDwbjNrmAE+VIC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Attributes

discord_token
MTI3MzA1MTEwNzEyMzI2OTczNQ.G7UQQo.CWRWd5HJJ8bVumSGiyWc2pDdjavw4VinikkJMg
server_id
1273454211354464348

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 2568	1944	Client-built.exe	30
PID 1944 wrote to memory of 2568	1944	Client-built.exe	30
PID 1944 wrote to memory of 2568	1944	Client-built.exe	30

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1944 -s 596
  2⤵
  PID:2568

memory/1944-0-0x000007FEF5E13000-0x000007FEF5E14000-memory.dmp

Download

memory/1944-1-0x000000013F430000-0x000000013F448000-memory.dmp

Download

memory/1944-2-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Download

memory/1944-3-0x000007FEF5E13000-0x000007FEF5E14000-memory.dmp

Download

memory/1944-4-0x000007FEF5E10000-0x000007FEF67FC000-memory.dmp

Download