discordrat | caaf43b82fc39e464005e56f4334a2ffb68d42949687c835c9d3385126af0fab

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 15:49

Target

caaf43b82fc39e464005e56f4334a2ffb68d42949687c835c9d3385126af0fab.exe
Size

133KB
MD5

95f1b3db3f20fa8d39d0becaf62a2382
SHA1

8f172757c90e99b36a6c88caa1dfd7dcc8d36576
SHA256

caaf43b82fc39e464005e56f4334a2ffb68d42949687c835c9d3385126af0fab
SHA512

ad37bdeb428e6ac4acf44f7e4852eb5e107a91d8937d848a5bcfcbf91ab4ef266e5f0704e711713660a2c0e7a35e7c86538d7a76c12b51691e7442204a93768c
SSDEEP

1536:62WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+7PIHxrq7ijr:6Zv5PDwbjNrmAE+zIE7iP

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI4NjM1MTAxNTMyMjQ1NjA4NQ.G554Sc.ny0RfKCv1Nk9qm4Lto4vbnjcXCnSEgyfISBGi8
server_id
1286350925296042046

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 1156	808	caaf43b82fc39e464005e56f4334a2ffb68d42949687c835c9d3385126af0fab.exe	30
PID 808 wrote to memory of 1156	808	caaf43b82fc39e464005e56f4334a2ffb68d42949687c835c9d3385126af0fab.exe	30
PID 808 wrote to memory of 1156	808	caaf43b82fc39e464005e56f4334a2ffb68d42949687c835c9d3385126af0fab.exe	30

C:\Users\Admin\AppData\Local\Temp\caaf43b82fc39e464005e56f4334a2ffb68d42949687c835c9d3385126af0fab.exe
"C:\Users\Admin\AppData\Local\Temp\caaf43b82fc39e464005e56f4334a2ffb68d42949687c835c9d3385126af0fab.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 808 -s 596
  2⤵
  PID:1156

memory/808-0-0x000007FEF5BE3000-0x000007FEF5BE4000-memory.dmp

Filesize
4KB

Download
memory/808-1-0x000000013FA50000-0x000000013FA76000-memory.dmp

Filesize
152KB

Download
memory/808-2-0x000007FEF5BE0000-0x000007FEF65CC000-memory.dmp

Filesize
9.9MB

Download
memory/808-3-0x000007FEF5BE3000-0x000007FEF5BE4000-memory.dmp

Filesize
4KB

Download
memory/808-4-0x000007FEF5BE0000-0x000007FEF65CC000-memory.dmp

Filesize
9.9MB

Download