discordrat | 094e3c75502b5f41db0d7449fa08b0afcd4043cfb43fc2cb0ec849815802c845

Analysis

max time kernel
12s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/10/2024, 08:10

Target

McForceOp.exe
Size

78KB
MD5

505e0aaa6fd221a88555f235fda98267
SHA1

14eda24cc513664e6df47232c678df1c0e5bc43a
SHA256

094e3c75502b5f41db0d7449fa08b0afcd4043cfb43fc2cb0ec849815802c845
SHA512

a24d1ab43b19f1ea3d66b12799dce3b5567791fe612c6cdfb0a7ddd27287e55c9443f3a3bacaa9bf2794550437088940247bb37618110f0f39707434b03151d8
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+DPIC:5Zv5PDwbjNrmAE+bIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI3NzUzNTg3MzYxMjY0NDQ3NA.Gq6rfp.9RlUKcMk31okJxZ2Dykafs1b9vfFyq-ZQTfTrU
server_id
1287401873288073236

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2092	2992	McForceOp.exe	30
PID 2992 wrote to memory of 2092	2992	McForceOp.exe	30
PID 2992 wrote to memory of 2092	2992	McForceOp.exe	30

C:\Users\Admin\AppData\Local\Temp\McForceOp.exe
"C:\Users\Admin\AppData\Local\Temp\McForceOp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2992 -s 596
  2⤵
  PID:2092

memory/2992-0-0x000007FEF6493000-0x000007FEF6494000-memory.dmp

Filesize
4KB

Download
memory/2992-1-0x000000013F870000-0x000000013F888000-memory.dmp

Filesize
96KB

Download
memory/2992-2-0x000007FEF6490000-0x000007FEF6E7C000-memory.dmp

Filesize
9.9MB

Download
memory/2992-3-0x000007FEF6493000-0x000007FEF6494000-memory.dmp

Filesize
4KB

Download
memory/2992-4-0x000007FEF6490000-0x000007FEF6E7C000-memory.dmp

Filesize
9.9MB

Download