discordrat | 2bf5883c565a2ca2bd2f8b86f8237936a784bae717a778d5c389455b80e38428

Analysis

max time kernel
16s
max time network
22s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
07-09-2024 16:59

Target

Client-built.exe
Size

78KB
MD5

896a809d31572f36ae309cc4e0e4f83a
SHA1

475516bd21f8b755a41bacb9dfae918d913f1a65
SHA256

2bf5883c565a2ca2bd2f8b86f8237936a784bae717a778d5c389455b80e38428
SHA512

e477764f8d87bb404d70be133c29b4bf2fae752e74ebf3fd07a79c5fddf76b96e005baf6cd39ad949bb875f978ef8e6f294915f7eb9b7d33d9a4d5490784e88e
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+cPIC:5Zv5PDwbjNrmAE+QIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI3OTMzNzI0NDUxOTMwMTE4MA.GOw-S5.o5k3EpcAZ5nDw2sQD40ybvdPi2Q3Hz-ydhmzcA
server_id
1279122304999100426

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 2880	1520	Client-built.exe	30
PID 1520 wrote to memory of 2880	1520	Client-built.exe	30
PID 1520 wrote to memory of 2880	1520	Client-built.exe	30

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1520 -s 596
  2⤵
  PID:2880

memory/1520-0-0x000007FEF5EA3000-0x000007FEF5EA4000-memory.dmp

Filesize
4KB

Download
memory/1520-1-0x000000013F970000-0x000000013F988000-memory.dmp

Filesize
96KB

Download
memory/1520-2-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp

Filesize
9.9MB

Download
memory/1520-3-0x000007FEF5EA3000-0x000007FEF5EA4000-memory.dmp

Filesize
4KB

Download
memory/1520-4-0x000007FEF5EA0000-0x000007FEF688C000-memory.dmp

Filesize
9.9MB

Download