discordrat | d50b2c87eb6675be372e9b726bdde090464b77a05d92094c1c85b4ef41e0e0f3

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/10/2024, 04:47

Target

d50b2c87eb6675be372e9b726bdde090464b77a05d92094c1c85b4ef41e0e0f3N.exe
Size

78KB
MD5

db69b3f085d983a9072d6c1ecf02ede0
SHA1

05867f8d314aeeb39d4fe81f659feb06b9cac736
SHA256

d50b2c87eb6675be372e9b726bdde090464b77a05d92094c1c85b4ef41e0e0f3
SHA512

10a68cc143c3af7774e0222c90a524e992f7e5197cf415fe529d0ce2db21d63b2f716723a661966bf90ea00417b9963cdba332b926e1259ed67df92d7c25de2a
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+APIC:5Zv5PDwbjNrmAE+kIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTA0Mjc5OTAzOTk0NDU5MzQyOA.GchQtk.Qc_Fd-kzpSK-nfUeW-_fqjYVGeHRHbZYVIeiyk
server_id
1055514010235191326

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 3004	1564	d50b2c87eb6675be372e9b726bdde090464b77a05d92094c1c85b4ef41e0e0f3N.exe	29
PID 1564 wrote to memory of 3004	1564	d50b2c87eb6675be372e9b726bdde090464b77a05d92094c1c85b4ef41e0e0f3N.exe	29
PID 1564 wrote to memory of 3004	1564	d50b2c87eb6675be372e9b726bdde090464b77a05d92094c1c85b4ef41e0e0f3N.exe	29

C:\Users\Admin\AppData\Local\Temp\d50b2c87eb6675be372e9b726bdde090464b77a05d92094c1c85b4ef41e0e0f3N.exe
"C:\Users\Admin\AppData\Local\Temp\d50b2c87eb6675be372e9b726bdde090464b77a05d92094c1c85b4ef41e0e0f3N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1564 -s 600
  2⤵
  PID:3004

memory/1564-0-0x000007FEF57E3000-0x000007FEF57E4000-memory.dmp

Filesize
4KB

Download
memory/1564-1-0x000000013F200000-0x000000013F218000-memory.dmp

Filesize
96KB

Download
memory/1564-2-0x000007FEF57E0000-0x000007FEF61CC000-memory.dmp

Filesize
9.9MB

Download
memory/1564-3-0x000007FEF57E0000-0x000007FEF61CC000-memory.dmp

Filesize
9.9MB

Download