discordrat | ba5ffd087b3a54c77b4db191c2a755d1ac8785c961607a6dc18bd2f7cec5d05e

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
15-08-2024 07:59

Target

startUp.exe
Size

78KB
MD5

d9fb67b05ff0e222de22986ae8e1d267
SHA1

72c030ea6263d1eb696e573543d050760aaf9ba1
SHA256

ba5ffd087b3a54c77b4db191c2a755d1ac8785c961607a6dc18bd2f7cec5d05e
SHA512

8508268766bcf28bc1203c73d03ab0676ea645ea4a8034fd4bd28ec68c9e63c6df3f44551829a60763ed1c97435e2968bdcc5d61e9bba87221243cc56575a743
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+EPIC:5Zv5PDwbjNrmAE+YIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTE5MTM5MjgwNTUxNjQ3NjQyNg.G5XJUK.HjtQ7ee5W55epw2DuQzQmZY_YOKocpEDDrEFIY
server_id
1270003925323481189

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2788	2652	startUp.exe	30
PID 2652 wrote to memory of 2788	2652	startUp.exe	30
PID 2652 wrote to memory of 2788	2652	startUp.exe	30

C:\Users\Admin\AppData\Local\Temp\startUp.exe
"C:\Users\Admin\AppData\Local\Temp\startUp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2652 -s 600
  2⤵
  PID:2788

memory/2652-0-0x000007FEF52E3000-0x000007FEF52E4000-memory.dmp

Filesize
4KB

Download
memory/2652-1-0x000000013F810000-0x000000013F828000-memory.dmp

Filesize
96KB

Download
memory/2652-2-0x000007FEF52E0000-0x000007FEF5CCC000-memory.dmp

Filesize
9.9MB

Download
memory/2652-3-0x000007FEF52E3000-0x000007FEF52E4000-memory.dmp

Filesize
4KB

Download
memory/2652-4-0x000007FEF52E0000-0x000007FEF5CCC000-memory.dmp

Filesize
9.9MB

Download