discordrat | 44353669c69e1b2f77c891fdee2c5e935d30e36c18be5b20e44062c66af28e32

Resubmissions

14-09-2024 14:14

14-09-2024 10:14

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14-09-2024 10:14

Target

FreeRobux.exe
Size

78KB
MD5

041960d257c7b96c4be63450c10a517f
SHA1

be6c8d7390f077b7afd5fe88f781f6ec4407be7d
SHA256

44353669c69e1b2f77c891fdee2c5e935d30e36c18be5b20e44062c66af28e32
SHA512

57a6f47666e6c3f3c7c553211e638643aa2a6f6196ff22c5a0817a9182971701e721919e72ea9a4f281f582c3bd478ff9501f8a9980ce89de018c3141f42a9e4
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+iPIC:5Zv5PDwbjNrmAE+OIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI4NDQzMjk3MTkwMTgzMzIyNw.GFmNsf.p73rhcMMsLIbgL13MHzRo9scT2hhlm_2Vrbzpc
server_id
1284433394939330651

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2848	2736	FreeRobux.exe	30
PID 2736 wrote to memory of 2848	2736	FreeRobux.exe	30
PID 2736 wrote to memory of 2848	2736	FreeRobux.exe	30

C:\Users\Admin\AppData\Local\Temp\FreeRobux.exe
"C:\Users\Admin\AppData\Local\Temp\FreeRobux.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2736 -s 596
  2⤵
  PID:2848

memory/2736-0-0x000007FEF5D83000-0x000007FEF5D84000-memory.dmp

Filesize
4KB

Download
memory/2736-1-0x000000013F770000-0x000000013F788000-memory.dmp

Filesize
96KB

Download
memory/2736-2-0x000007FEF5D80000-0x000007FEF676C000-memory.dmp

Filesize
9.9MB

Download
memory/2736-3-0x000007FEF5D83000-0x000007FEF5D84000-memory.dmp

Filesize
4KB

Download
memory/2736-4-0x000007FEF5D80000-0x000007FEF676C000-memory.dmp

Filesize
9.9MB

Download