discordrat | 2ceab55fdcc8bee3e400ef8c6e7a122069b7048e23f6e5df4f09ae3a81708c92

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-10-2024 02:35

Target

2ceab55fdcc8bee3e400ef8c6e7a122069b7048e23f6e5df4f09ae3a81708c92N.exe
Size

78KB
MD5

d344b357082279bbc8e663f5973e1aa0
SHA1

5ff3177049fda1d971ed640490e3d330c2966b3e
SHA256

2ceab55fdcc8bee3e400ef8c6e7a122069b7048e23f6e5df4f09ae3a81708c92
SHA512

b661449236b4b3d54955e76fc22715ad059b13ccdd226a852102c7cb9ff35f79607749422e27cf3f6f8cf7a69e34ec2215998cfa3601d271f958b13658f21b53
SSDEEP

1536:d2WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+ZPIu:dZv5PDwbjNrmAE+pIu

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI4OTEwMTg2MzU4NDY2NTYzMg.GD-6LB.yiM8zkzK4aXylYFCUOlYXkhR7BZO-tseW-TfWI
server_id
1289102386337681470

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2ceab55fdcc8bee3e400ef8c6e7a122069b7048e23f6e5df4f09ae3a81708c92N.exe

description	pid	Process	procid_target
PID 2380 wrote to memory of 1032	2380	2ceab55fdcc8bee3e400ef8c6e7a122069b7048e23f6e5df4f09ae3a81708c92N.exe	28
PID 2380 wrote to memory of 1032	2380	2ceab55fdcc8bee3e400ef8c6e7a122069b7048e23f6e5df4f09ae3a81708c92N.exe	28
PID 2380 wrote to memory of 1032	2380	2ceab55fdcc8bee3e400ef8c6e7a122069b7048e23f6e5df4f09ae3a81708c92N.exe	28

C:\Users\Admin\AppData\Local\Temp\2ceab55fdcc8bee3e400ef8c6e7a122069b7048e23f6e5df4f09ae3a81708c92N.exe
"C:\Users\Admin\AppData\Local\Temp\2ceab55fdcc8bee3e400ef8c6e7a122069b7048e23f6e5df4f09ae3a81708c92N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2380 -s 600
  2⤵
  PID:1032

memory/2380-0-0x000007FEF57C3000-0x000007FEF57C4000-memory.dmp

Filesize
4KB

Download
memory/2380-1-0x000000013F380000-0x000000013F398000-memory.dmp

Filesize
96KB

Download
memory/2380-2-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/2380-3-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download