discordrat | c3e14fd92045156be0d0f7f7b60e721d6440486846d68334c278e14f489df801

Analysis

max time kernel
30s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-09-2024 16:59

Target

Exam.exe
Size

78KB
MD5

813f0ea8121e1f568d5f28ea4a101509
SHA1

f1d173fc49fd18d7774cfc68fedeaf95a1f15f4d
SHA256

c3e14fd92045156be0d0f7f7b60e721d6440486846d68334c278e14f489df801
SHA512

fcafd593200a536904032a7185f16b0c7539d3f16a4b4d24323bb972dca8544264d579629289d3996109a751fc2b8075ef4380fd83d9fd6fb46cca7b47f1b552
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+CPIC:5Zv5PDwbjNrmAE+uIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI4MDUzMzE0ODI3NDI2NjIzNA.GNshbu.eYjJ-sX-1p9r3tXmv5qXWadMWDQTYe4OhLNXr0
server_id
1280531888624369726

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2712	2844	Exam.exe	31
PID 2844 wrote to memory of 2712	2844	Exam.exe	31
PID 2844 wrote to memory of 2712	2844	Exam.exe	31

C:\Users\Admin\AppData\Local\Temp\Exam.exe
"C:\Users\Admin\AppData\Local\Temp\Exam.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2844 -s 596
  2⤵
  PID:2712

memory/2844-2-0x000007FEF52D0000-0x000007FEF5CBC000-memory.dmp

Filesize
9.9MB

Download
memory/2844-1-0x000000013F080000-0x000000013F098000-memory.dmp

Filesize
96KB

Download
memory/2844-0-0x000007FEF52D3000-0x000007FEF52D4000-memory.dmp

Filesize
4KB

Download
memory/2844-3-0x000007FEF52D3000-0x000007FEF52D4000-memory.dmp

Filesize
4KB

Download
memory/2844-4-0x000007FEF52D0000-0x000007FEF5CBC000-memory.dmp

Filesize
9.9MB

Download
memory/2844-5-0x000007FEF52D0000-0x000007FEF5CBC000-memory.dmp

Filesize
9.9MB

Download