discordrat | 95e5f46c36b28533bbf92f1a264dcc439aea1b0e030e360998e830b5b7036edf

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
20-09-2024 15:31

Target

DiscordHackerTools.exe
Size

90KB
MD5

fdd2dbdc384cfcedf86537203b6ed986
SHA1

37f7f2ccc0f594445ccc1b846da2cf7885dfea6d
SHA256

95e5f46c36b28533bbf92f1a264dcc439aea1b0e030e360998e830b5b7036edf
SHA512

161d6524e73891b719c28b29e95734f30ace6e93771164faed3bdab689e59ef641e5645ee5c5d458518b5200f865dcc62ab4336b2f899bbcaef79cced0c6538c
SSDEEP

1536:sbPjt72uOFmYskRPUAqtBTldwr0bpAkA/rZgbGNra+uexCxoKV6+f2vH:ajtyuOFpskpgBTlugmgbGNra+bS2P

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI4NjY5NzM2MzA0OTY3NjgyMg.GXVoQY.9z4vKuRhM26WGS-YJsP0Qdv7XSkZ1mvw0jZ_4w
server_id
1286696321482489930

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 1832	2544	DiscordHackerTools.exe	29
PID 2544 wrote to memory of 1832	2544	DiscordHackerTools.exe	29
PID 2544 wrote to memory of 1832	2544	DiscordHackerTools.exe	29

C:\Users\Admin\AppData\Local\Temp\DiscordHackerTools.exe
"C:\Users\Admin\AppData\Local\Temp\DiscordHackerTools.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2544 -s 596
  2⤵
  PID:1832

memory/2544-0-0x000007FEF5643000-0x000007FEF5644000-memory.dmp

Filesize
4KB

Download
memory/2544-1-0x000000013FDE0000-0x000000013FDFC000-memory.dmp

Filesize
112KB

Download
memory/2544-2-0x000007FEF5640000-0x000007FEF602C000-memory.dmp

Filesize
9.9MB

Download
memory/2544-3-0x000007FEF5643000-0x000007FEF5644000-memory.dmp

Filesize
4KB

Download
memory/2544-4-0x000007FEF5640000-0x000007FEF602C000-memory.dmp

Filesize
9.9MB

Download