discordrat | ef2299993e938765d921d5c23083d7a58003be83d96aba290ce99151803da448

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 14:05

Target

ef2299993e938765d921d5c23083d7a58003be83d96aba290ce99151803da448.exe
Size

78KB
MD5

7a5b08e9010d1ebcf45d3bd6f1307109
SHA1

b85a4f005d5dfbbc4f342d64c2ed3891418b93ba
SHA256

ef2299993e938765d921d5c23083d7a58003be83d96aba290ce99151803da448
SHA512

d3d8c7bd058e00345270a68bb6f5ef283a1e3f0187742bef569366343cb5e7b530eac8c5096e2e3ab437d7efbe0ea3088a9816020559a19fb8dfd400bbb557ee
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+YPIC:5Zv5PDwbjNrmAE+8IC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI4Nzc5NzA2NzAwMjk0MTU0Mw.GkMJ2K.jKBIRLRJtVbvy4Nj-GArf--oSVv_fqnChFlk60
server_id
1287797781037187083

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2752	2876	ef2299993e938765d921d5c23083d7a58003be83d96aba290ce99151803da448.exe	30
PID 2876 wrote to memory of 2752	2876	ef2299993e938765d921d5c23083d7a58003be83d96aba290ce99151803da448.exe	30
PID 2876 wrote to memory of 2752	2876	ef2299993e938765d921d5c23083d7a58003be83d96aba290ce99151803da448.exe	30

C:\Users\Admin\AppData\Local\Temp\ef2299993e938765d921d5c23083d7a58003be83d96aba290ce99151803da448.exe
"C:\Users\Admin\AppData\Local\Temp\ef2299993e938765d921d5c23083d7a58003be83d96aba290ce99151803da448.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2876 -s 600
  2⤵
  PID:2752

memory/2876-0-0x000007FEF5D93000-0x000007FEF5D94000-memory.dmp

Filesize
4KB

Download
memory/2876-1-0x000000013F4D0000-0x000000013F4E8000-memory.dmp

Filesize
96KB

Download
memory/2876-2-0x000007FEF5D90000-0x000007FEF677C000-memory.dmp

Filesize
9.9MB

Download
memory/2876-3-0x000007FEF5D90000-0x000007FEF677C000-memory.dmp

Filesize
9.9MB

Download