discordrat | d2d2664ee1d93b86c5cac6dfdb73e578cc6d17bc12ec498fc032a7616ccf17ab

Resubmissions

15/10/2024, 14:36

15/10/2024, 12:58

max time kernel
0s
max time network
0s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/10/2024, 14:36

Target
Release/Discord rat.exe
Size 79KB
Sample241015-ryzzaatfnj
SHA256 2bd631c6665656673a923c13359b0dc211debc05b2885127e26b0dce808e2dec
MD5 d13905e018eb965ded2e28ba0ab257b5
SHA1 6d7fe69566fddc69b33d698591c9a2c70d834858
SHA512 b95bfdebef33ac72b6c21cdf0abb4961222b7efd17267cd7236e731dd0b6105ece28e784a95455f1ffc8a6dd1d580a467b07b3bd8cb2fb19e2111f1a864c97cb
SSDEEP 1536:YCH0jBD2BKkwbPNrfxCXhRoKV6+V+y9viwp:VUjBD2BPwbPNrmAE+MqU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2684	2188	Discord rat.exe	30
PID 2188 wrote to memory of 2684	2188	Discord rat.exe	30
PID 2188 wrote to memory of 2684	2188	Discord rat.exe	30

C:\Users\Admin\AppData\Local\Temp\Release\Discord rat.exe
"C:\Users\Admin\AppData\Local\Temp\Release\Discord rat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2188 -s 596
  2⤵
  PID:2684

memory/2188-0-0x000007FEF5173000-0x000007FEF5174000-memory.dmp

Download

memory/2188-1-0x000000013F4D0000-0x000000013F4E8000-memory.dmp

Download

memory/2188-2-0x000007FEF5170000-0x000007FEF5B5C000-memory.dmp

Download