discordrat | 56ba52102e0d89e4e41fd3961fd68c0d73f5679f5ce85dd845a375acabf59fe3

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
15-08-2024 15:08

Target

main.exe
Size

78KB
MD5

96dabfdb879d4e87953da9d05a370a5b
SHA1

104b9ad34c8e2e46bdcf30b11053fc6973b1bb1e
SHA256

56ba52102e0d89e4e41fd3961fd68c0d73f5679f5ce85dd845a375acabf59fe3
SHA512

9de75c21adc62b01e29b9d77cf079c302eaa43708ff16e36121234f9ec14c562eb5059ea1f23f3a90d460c63eaf09d3a382ed0852d7cff98b60508af9e3b64af
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+xPIC:5Zv5PDwbjNrmAE+hIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI0ODIyMDgzODk2NTAyMjc2MQ.GHlJAX.HlU6Z6eLtRJcwppWYbf40So64WpfB5cMrCfWbo
server_id
1257738639413084372

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2056	2308	main.exe	31
PID 2308 wrote to memory of 2056	2308	main.exe	31
PID 2308 wrote to memory of 2056	2308	main.exe	31

C:\Users\Admin\AppData\Local\Temp\main.exe
"C:\Users\Admin\AppData\Local\Temp\main.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2308 -s 596
  2⤵
  PID:2056

memory/2308-0-0x000007FEF5C33000-0x000007FEF5C34000-memory.dmp

Filesize
4KB

Download
memory/2308-1-0x000000013FCC0000-0x000000013FCD8000-memory.dmp

Filesize
96KB

Download
memory/2308-2-0x000007FEF5C30000-0x000007FEF661C000-memory.dmp

Filesize
9.9MB

Download
memory/2308-3-0x000007FEF5C33000-0x000007FEF5C34000-memory.dmp

Filesize
4KB

Download
memory/2308-4-0x000007FEF5C30000-0x000007FEF661C000-memory.dmp

Filesize
9.9MB

Download