discordrat | 49c55d07cc4cd2d456b31ad01f50cb7333dc0d0b7e7aa8165c986009a57d47e8

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18/10/2024, 11:52

Target

49c55d07cc4cd2d456b31ad01f50cb7333dc0d0b7e7aa8165c986009a57d47e8N.exe
Size

78KB
MD5

690d275deef06959992b477da1fe3760
SHA1

79119bb57102fbba031cb101518c78554bc1fdfa
SHA256

49c55d07cc4cd2d456b31ad01f50cb7333dc0d0b7e7aa8165c986009a57d47e8
SHA512

2fb77577eb8bd0f2499cb6fddc8c4ef96fbe29a18747c33486c0cf68de1505dc5159dbdea1cf0acf81d8569fb9a64e454a5277b673e872e36cfc984bd1c04cd9
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+SPIC:5Zv5PDwbjNrmAE+eIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI5NDMzMDc5NDM4MjMyNzgxOA.GueeG1.SVyqI1p3Vm6Bs8CpJIHUzqFKgx7IqF7W2JQQN8
server_id
1294330554577063977

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2500	2860	49c55d07cc4cd2d456b31ad01f50cb7333dc0d0b7e7aa8165c986009a57d47e8N.exe	31
PID 2860 wrote to memory of 2500	2860	49c55d07cc4cd2d456b31ad01f50cb7333dc0d0b7e7aa8165c986009a57d47e8N.exe	31
PID 2860 wrote to memory of 2500	2860	49c55d07cc4cd2d456b31ad01f50cb7333dc0d0b7e7aa8165c986009a57d47e8N.exe	31

C:\Users\Admin\AppData\Local\Temp\49c55d07cc4cd2d456b31ad01f50cb7333dc0d0b7e7aa8165c986009a57d47e8N.exe
"C:\Users\Admin\AppData\Local\Temp\49c55d07cc4cd2d456b31ad01f50cb7333dc0d0b7e7aa8165c986009a57d47e8N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2860 -s 596
  2⤵
  PID:2500

memory/2860-0-0x000007FEF65E3000-0x000007FEF65E4000-memory.dmp

Filesize
4KB

Download
memory/2860-1-0x000000013F440000-0x000000013F458000-memory.dmp

Filesize
96KB

Download
memory/2860-2-0x000007FEF65E0000-0x000007FEF6FCC000-memory.dmp

Filesize
9.9MB

Download
memory/2860-3-0x000007FEF65E0000-0x000007FEF6FCC000-memory.dmp

Filesize
9.9MB

Download