discordrat | 02789b3da2b41ac36d34bd502a38685be7570de4d87563d1801bb433f75be4ad

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29-08-2024 21:52

Target

VencordUninstaller.exe
Size

78KB
MD5

f35e4873dbd0ed69cd4601c2179bce58
SHA1

d12ae6e855152dcdb50a1b184bdd73d7aba4b6c1
SHA256

02789b3da2b41ac36d34bd502a38685be7570de4d87563d1801bb433f75be4ad
SHA512

c93843f26d246cb76420b91bb978e78be93c9e3255d016b047c1b8a65361ac696291bb88e02b6723fe865dace63b6634918deec5de2f0e703978a89fa5a02db6
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+MPIC:5Zv5PDwbjNrmAE+gIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTIxOTc0MTE1OTE4NzAyNTk3MA.GxQ8YK.QbvsCszSsM7ESEbQ3Da6YVxn8KDKlMg83LFcgE
server_id
1278828140931846275

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2704	2528	VencordUninstaller.exe	29
PID 2528 wrote to memory of 2704	2528	VencordUninstaller.exe	29
PID 2528 wrote to memory of 2704	2528	VencordUninstaller.exe	29

C:\Users\Admin\AppData\Local\Temp\VencordUninstaller.exe
"C:\Users\Admin\AppData\Local\Temp\VencordUninstaller.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2528 -s 596
  2⤵
  PID:2704

memory/2528-2-0x000007FEF5670000-0x000007FEF605C000-memory.dmp

Filesize
9.9MB

Download
memory/2528-1-0x000000013F930000-0x000000013F948000-memory.dmp

Filesize
96KB

Download
memory/2528-0-0x000007FEF5673000-0x000007FEF5674000-memory.dmp

Filesize
4KB

Download
memory/2528-3-0x000007FEF5673000-0x000007FEF5674000-memory.dmp

Filesize
4KB

Download
memory/2528-4-0x000007FEF5670000-0x000007FEF605C000-memory.dmp

Filesize
9.9MB

Download