discordrat | 73a7fa43ce60a9ed547e29a9841d3d4fa98d3e1cd0a76f0adbf25ecd714e2fbb

Resubmissions

07/10/2024, 05:48

05/10/2024, 05:38

max time kernel
92s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 05:38

Target

RobuxGenerator.exe
Size

78KB
MD5

a925d6ec3fbdba8e4026ee5ffabe653d
SHA1

a2d74999bdda2fadaf0aa8b099801167f68e1e39
SHA256

73a7fa43ce60a9ed547e29a9841d3d4fa98d3e1cd0a76f0adbf25ecd714e2fbb
SHA512

90123106e504fd4d96e63f4d36d1c2fdeded6f7b5479672d900ce9eef42aec5e90ced704f138c0a4f64da2eb7773420bcc07d51091c183708d84edabddb56d63
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+gdPIC:5Zv5PDwbjNrmAE+gNIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI5MDE3NTAxNDM1NTczMDQ3Nw.G-EXaf.BysHjbuehzd47FNQQ3uQiIi6vnESuslp8aw13Q
server_id
1287264152271978496

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2216	2748	RobuxGenerator.exe	30
PID 2748 wrote to memory of 2216	2748	RobuxGenerator.exe	30
PID 2748 wrote to memory of 2216	2748	RobuxGenerator.exe	30

C:\Users\Admin\AppData\Local\Temp\RobuxGenerator.exe
"C:\Users\Admin\AppData\Local\Temp\RobuxGenerator.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2748 -s 600
  2⤵
  PID:2216

memory/2748-0-0x000007FEF5AF3000-0x000007FEF5AF4000-memory.dmp

Filesize
4KB

Download
memory/2748-1-0x000000013FD00000-0x000000013FD18000-memory.dmp

Filesize
96KB

Download
memory/2748-2-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

Filesize
9.9MB

Download
memory/2748-3-0x000007FEF5AF3000-0x000007FEF5AF4000-memory.dmp

Filesize
4KB

Download
memory/2748-4-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

Filesize
9.9MB

Download