discordrat | 37f79ef934775e7dbcd006be8c438435ffdd059ef4674cee8b988835f5ad2ae9

Analysis

max time kernel
111s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-09-2024 13:38

Target

871ec39c515d1e6f6594696404868c50N.exe
Size

78KB
MD5

871ec39c515d1e6f6594696404868c50
SHA1

b93d20a7e926b1396be5ba887ae72cdc28cdc101
SHA256

37f79ef934775e7dbcd006be8c438435ffdd059ef4674cee8b988835f5ad2ae9
SHA512

bec7154db76b64ec6ef02164e6959664299ed54fa85d74d7a010d21f2e43e9bcf3b16f9c9fea4c8798325e5e0978d66803014e64342ffbac0cbc2745f7e399ea
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+M/PIC:5Zv5PDwbjNrmAE+MIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI4MTE5OTI3Mzg3NDI5Njg2Mg.Go_Acr.HUIHPEQaWjoIWxj4Geox9QLBiEggb5zNfnhqSk
server_id
1276135122353131575

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 3060	2352	871ec39c515d1e6f6594696404868c50N.exe	29
PID 2352 wrote to memory of 3060	2352	871ec39c515d1e6f6594696404868c50N.exe	29
PID 2352 wrote to memory of 3060	2352	871ec39c515d1e6f6594696404868c50N.exe	29

C:\Users\Admin\AppData\Local\Temp\871ec39c515d1e6f6594696404868c50N.exe
"C:\Users\Admin\AppData\Local\Temp\871ec39c515d1e6f6594696404868c50N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2352 -s 600
  2⤵
  PID:3060

memory/2352-0-0x000007FEF6203000-0x000007FEF6204000-memory.dmp

Filesize
4KB

Download
memory/2352-1-0x000000013FD20000-0x000000013FD38000-memory.dmp

Filesize
96KB

Download
memory/2352-2-0x000007FEF6200000-0x000007FEF6BEC000-memory.dmp

Filesize
9.9MB

Download
memory/2352-3-0x000007FEF6203000-0x000007FEF6204000-memory.dmp

Filesize
4KB

Download
memory/2352-4-0x000007FEF6200000-0x000007FEF6BEC000-memory.dmp

Filesize
9.9MB

Download