discordrat | 6d1703bd786779f40dbb4cfd0de3e39ed7f09afcb8e3555aabc1bf6839ccb4da

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
08-09-2024 10:10

Target

FPS.exe
Size

78KB
MD5

b330768ecab3abad7aff662542e47b98
SHA1

9182c254d638fdb07f64819f113af6e3ed34466d
SHA256

6d1703bd786779f40dbb4cfd0de3e39ed7f09afcb8e3555aabc1bf6839ccb4da
SHA512

b62c74545b125dcd6afb4a7923ef52b6b9ac798796e82e7d2229e6748a8728fecbbd197375ebf6e2941451d0ffeb3c1b1d2e33d6d86792b65cb0d1ab75c4949d
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+JPIC:5Zv5PDwbjNrmAE+5IC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI4MjIzOTgwNDU4NjU5NDMxOQ.GEkcj7.DZZa25XaQvgv-ZVRs-HJbbZyRm7z_fvhKTVxyU
server_id
1282239514231701626

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1768	2020	FPS.exe	30
PID 2020 wrote to memory of 1768	2020	FPS.exe	30
PID 2020 wrote to memory of 1768	2020	FPS.exe	30

C:\Users\Admin\AppData\Local\Temp\FPS.exe
"C:\Users\Admin\AppData\Local\Temp\FPS.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2020 -s 600
  2⤵
  PID:1768

memory/2020-0-0x000007FEF5E73000-0x000007FEF5E74000-memory.dmp

Filesize
4KB

Download
memory/2020-1-0x000000013FE60000-0x000000013FE78000-memory.dmp

Filesize
96KB

Download
memory/2020-2-0x000007FEF5E70000-0x000007FEF685C000-memory.dmp

Filesize
9.9MB

Download
memory/2020-3-0x000007FEF5E73000-0x000007FEF5E74000-memory.dmp

Filesize
4KB

Download
memory/2020-4-0x000007FEF5E70000-0x000007FEF685C000-memory.dmp

Filesize
9.9MB

Download