discordrat | 2bf5883c565a2ca2bd2f8b86f8237936a784bae717a778d5c389455b80e38428

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-09-2024 15:37

Target

Client-built.exe
Size

78KB
MD5

896a809d31572f36ae309cc4e0e4f83a
SHA1

475516bd21f8b755a41bacb9dfae918d913f1a65
SHA256

2bf5883c565a2ca2bd2f8b86f8237936a784bae717a778d5c389455b80e38428
SHA512

e477764f8d87bb404d70be133c29b4bf2fae752e74ebf3fd07a79c5fddf76b96e005baf6cd39ad949bb875f978ef8e6f294915f7eb9b7d33d9a4d5490784e88e
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+cPIC:5Zv5PDwbjNrmAE+QIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI3OTMzNzI0NDUxOTMwMTE4MA.GOw-S5.o5k3EpcAZ5nDw2sQD40ybvdPi2Q3Hz-ydhmzcA
server_id
1279122304999100426

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 1832	2656	Client-built.exe	30
PID 2656 wrote to memory of 1832	2656	Client-built.exe	30
PID 2656 wrote to memory of 1832	2656	Client-built.exe	30

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2656 -s 600
  2⤵
  PID:1832

memory/2656-0-0x000007FEF6493000-0x000007FEF6494000-memory.dmp

Filesize
4KB

Download
memory/2656-1-0x000000013FCE0000-0x000000013FCF8000-memory.dmp

Filesize
96KB

Download
memory/2656-2-0x000007FEF6490000-0x000007FEF6E7C000-memory.dmp

Filesize
9.9MB

Download
memory/2656-3-0x000007FEF6493000-0x000007FEF6494000-memory.dmp

Filesize
4KB

Download
memory/2656-4-0x000007FEF6490000-0x000007FEF6E7C000-memory.dmp

Filesize
9.9MB

Download