discordrat | 5807ce4e87716a5bc909df73c563dd643da24a01704e15db6b6d638850c585ea

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21-08-2024 10:04

Target

EasyCheating.exe
Size

50KB
MD5

a262aecc8e8dc29650ff5e11d7b3c276
SHA1

c6dc0c79fc0616fc7ba0d58e005bb2c62c9f8012
SHA256

5807ce4e87716a5bc909df73c563dd643da24a01704e15db6b6d638850c585ea
SHA512

993f6cb26939417567be9c739cba44553cd4b2e9d27d158031aafe6c7baa46b9b35e285b0a9294788d8d055b121be19d6f09f8f693f9eccaa06ad18804726b07
SSDEEP

768:Tmr2rBQ1wWOQgdSR8qKugZa3lbaxgGjX0/o9Bv60mifhhIZtWLqiO:qAwwFQgEBC03haxfk/G160XInWLY

Score

10^/10

Family

discordrat

Attributes

discord_token
MTEyMTQyMDgwMTYyNzkyMjU3Mw.G4jNQO.MglsuiS1ldNvX29tR2kywKn8IorYGQT7wUNojo
server_id
1271887603272122468

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2816	2668	EasyCheating.exe	31
PID 2668 wrote to memory of 2816	2668	EasyCheating.exe	31
PID 2668 wrote to memory of 2816	2668	EasyCheating.exe	31

C:\Users\Admin\AppData\Local\Temp\EasyCheating.exe
"C:\Users\Admin\AppData\Local\Temp\EasyCheating.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2668 -s 632
  2⤵
  PID:2816

memory/2668-0-0x000007FEF5A73000-0x000007FEF5A74000-memory.dmp

Filesize
4KB

Download
memory/2668-1-0x000000013FFE0000-0x000000013FFF0000-memory.dmp

Filesize
64KB

Download
memory/2668-2-0x00000000005D0000-0x00000000005E8000-memory.dmp

Filesize
96KB

Download
memory/2668-3-0x000007FEF5A70000-0x000007FEF645C000-memory.dmp

Filesize
9.9MB

Download
memory/2668-4-0x000007FEF5A73000-0x000007FEF5A74000-memory.dmp

Filesize
4KB

Download
memory/2668-5-0x000007FEF5A70000-0x000007FEF645C000-memory.dmp

Filesize
9.9MB

Download