discordrat | e70d13c5cc084cf5dab68b96b26540995bd1d75932c1cc24e1f81021ed85bfa1

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-09-2024 08:54

Target

Client-built.exe
Size

78KB
MD5

f529efa0046adeeb1d509c4a43586bc5
SHA1

23d7ccccc1612231cfe0bb66bb86ea5db1dda4b5
SHA256

44cbfa948192f12da3cafb7def9707ed0713a8e89c30ec273c7860e6af6cc848
SHA512

f690a716a0d57ca91b062d30e354a3309b76f0febda92fc93c0d83da7e29ce2a5c662614ae2df609dc2c0add54c1b907e13f0a13552841de1e0aeb22e92c8cea
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+ZPIC:5Zv5PDwbjNrmAE+pIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI4Mjk4NTE1ODQ3MDc5OTM3MA.G1JUH3.FzD6ZQMQJ5txQxLGOPsFdm790kpt3XU9y_f-Ao
server_id
1282984914459033672

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 2632	2616	Client-built.exe	30
PID 2616 wrote to memory of 2632	2616	Client-built.exe	30
PID 2616 wrote to memory of 2632	2616	Client-built.exe	30

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2616 -s 596
  2⤵
  PID:2632

memory/2616-0-0x000007FEF4E33000-0x000007FEF4E34000-memory.dmp

Filesize
4KB

Download
memory/2616-1-0x000000013F8F0000-0x000000013F908000-memory.dmp

Filesize
96KB

Download
memory/2616-2-0x000007FEF4E30000-0x000007FEF581C000-memory.dmp

Filesize
9.9MB

Download
memory/2616-3-0x000007FEF4E33000-0x000007FEF4E34000-memory.dmp

Filesize
4KB

Download
memory/2616-4-0x000007FEF4E30000-0x000007FEF581C000-memory.dmp

Filesize
9.9MB

Download