discordrat | da4aa77f84aec83c245fec4e29a3494c2e9210597b32c5b55f0f9ac288dbb1fe

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 18:42

Target

freeadblocker.exe
Size

78KB
MD5

e97e6c4b84ebe3f39a84b274f2923420
SHA1

2b66fcdaf064cb73197341f6d4a9c17ad54b01c4
SHA256

da4aa77f84aec83c245fec4e29a3494c2e9210597b32c5b55f0f9ac288dbb1fe
SHA512

540439d42142f4d51f130efba5e505d80e524610a94e8bde8602e2acc9586c007671e750ae219b0cb8e21ba4360e5754b6e31465aea66ce0ce544c4c0b30d060
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+MPIC:5Zv5PDwbjNrmAE+gIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI4NTMzMjE4NzIyNjU3MDg5NQ.G8JbnQ.e3hcNRGJvvOi8ZO6GYOCKIQI-BykD71Mo5llnc
server_id
1281541058815066162

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2500	1988	freeadblocker.exe	30
PID 1988 wrote to memory of 2500	1988	freeadblocker.exe	30
PID 1988 wrote to memory of 2500	1988	freeadblocker.exe	30

C:\Users\Admin\AppData\Local\Temp\freeadblocker.exe
"C:\Users\Admin\AppData\Local\Temp\freeadblocker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1988 -s 600
  2⤵
  PID:2500

memory/1988-0-0x000007FEF5143000-0x000007FEF5144000-memory.dmp

Filesize
4KB

Download
memory/1988-1-0x000000013F4B0000-0x000000013F4C8000-memory.dmp

Filesize
96KB

Download
memory/1988-2-0x000007FEF5140000-0x000007FEF5B2C000-memory.dmp

Filesize
9.9MB

Download
memory/1988-3-0x000007FEF5143000-0x000007FEF5144000-memory.dmp

Filesize
4KB

Download
memory/1988-4-0x000007FEF5140000-0x000007FEF5B2C000-memory.dmp

Filesize
9.9MB

Download