discordrat | e0d5cedfc19c63b1015d0681295235eea136d0655219943557019b18effb8987

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/09/2024, 03:22

Target

SStlr.exe
Size

78KB
MD5

d2beca772cce31705d4ac2c7f7577ad8
SHA1

7371b8963fff597ce5f5512904e4f8ab879a06a3
SHA256

e0d5cedfc19c63b1015d0681295235eea136d0655219943557019b18effb8987
SHA512

6520ed2fb64bdea2898b40873f715ad9afd5e14729c383474d81e0773f42889b74848102bfd789e39a6ede5f0904a7a66496c70d59792de1d92b8818f384eb16
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+OPIC:5Zv5PDwbjNrmAE+qIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI4NjA4MjY0OTUyOTUxNjA2NA.Gcx-AZ.UfnCLixPx9n_RbsOFtBOxB5V9Q_ek3rSRCt2S0
server_id
1285374325309968404

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 1944	2320	SStlr.exe	29
PID 2320 wrote to memory of 1944	2320	SStlr.exe	29
PID 2320 wrote to memory of 1944	2320	SStlr.exe	29

C:\Users\Admin\AppData\Local\Temp\SStlr.exe
"C:\Users\Admin\AppData\Local\Temp\SStlr.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2320 -s 604
  2⤵
  PID:1944

memory/2320-0-0x000007FEF63B3000-0x000007FEF63B4000-memory.dmp

Filesize
4KB

Download
memory/2320-1-0x000000013FCE0000-0x000000013FCF8000-memory.dmp

Filesize
96KB

Download
memory/2320-2-0x000007FEF63B0000-0x000007FEF6D9C000-memory.dmp

Filesize
9.9MB

Download
memory/2320-3-0x000007FEF63B3000-0x000007FEF63B4000-memory.dmp

Filesize
4KB

Download
memory/2320-4-0x000007FEF63B0000-0x000007FEF6D9C000-memory.dmp

Filesize
9.9MB

Download