discordrat | d9f31b6c8b884988ba6c59fd1ddd2da1e8bb52879ce8ac54076665287ecd1618

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07-09-2024 00:24

Target

Client-built.exe
Size

78KB
MD5

83966d119ab8a8d9dd67c81fc74b6849
SHA1

437ac0b1f90225d40649f1b41ec8cc3dac8ff94e
SHA256

d9f31b6c8b884988ba6c59fd1ddd2da1e8bb52879ce8ac54076665287ecd1618
SHA512

6cac9e7b6a682ad217742f072330b8194414be7768a144099e507a7b697439cb62fa4a8985c15e1482831757ead35065779d3896a0156955ed83ff4827328c90
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+zPIC:5Zv5PDwbjNrmAE+rIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI4MTMwOTQwOTQ1NjQyMzAyNA.GkG_Wq.5dYm5G6kYZ8NsYc3vLF-hn3wxksVXeRY6bL3ZQ
server_id
1281767679224447079

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 3068	1976	Client-built.exe	30
PID 1976 wrote to memory of 3068	1976	Client-built.exe	30
PID 1976 wrote to memory of 3068	1976	Client-built.exe	30

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1976 -s 596
  2⤵
  PID:3068

memory/1976-0-0x000007FEF65A3000-0x000007FEF65A4000-memory.dmp

Filesize
4KB

Download
memory/1976-1-0x000000013FA10000-0x000000013FA28000-memory.dmp

Filesize
96KB

Download
memory/1976-2-0x000007FEF65A0000-0x000007FEF6F8C000-memory.dmp

Filesize
9.9MB

Download
memory/1976-3-0x000007FEF65A3000-0x000007FEF65A4000-memory.dmp

Filesize
4KB

Download
memory/1976-4-0x000007FEF65A0000-0x000007FEF6F8C000-memory.dmp

Filesize
9.9MB

Download