discordrat | 0377de27cce2b169ad1f3ca2c1b7bc85ba1c4b7ced9d02ad3aeea55982d248cd

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-09-2024 18:51

Target

Client-built.exe
Size

78KB
MD5

78d03f901ec29f9a0ae6914d72a70fa0
SHA1

80aa7c600fe6aef92e28fa36fa9faf6d74af2418
SHA256

0377de27cce2b169ad1f3ca2c1b7bc85ba1c4b7ced9d02ad3aeea55982d248cd
SHA512

1f0c1127a11294d68750cd3627826adad38cbba2cf1cfaf29d40fe0d16149c0700328ac4a98bf78c24e4dc9620414ab3dbf149b0f542ee77c7d80a5d2a0f1184
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+sPIC:5Zv5PDwbjNrmAE+AIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI4MzQ5Njg4ODU3Mzg5MDU2MA.G0CwMZ.iBMsXaOTjB__C6FtAQgaQ8yuZ6VJUrGf4VDtBI
server_id
1206159701453049889

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2272	3020	Client-built.exe	30
PID 3020 wrote to memory of 2272	3020	Client-built.exe	30
PID 3020 wrote to memory of 2272	3020	Client-built.exe	30

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3020 -s 600
  2⤵
  PID:2272

memory/3020-0-0x000007FEF5463000-0x000007FEF5464000-memory.dmp

Filesize
4KB

Download
memory/3020-1-0x000000013F600000-0x000000013F618000-memory.dmp

Filesize
96KB

Download
memory/3020-2-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

Filesize
9.9MB

Download
memory/3020-3-0x000007FEF5463000-0x000007FEF5464000-memory.dmp

Filesize
4KB

Download
memory/3020-4-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

Filesize
9.9MB

Download
memory/3020-5-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmp

Filesize
9.9MB

Download