discordrat | e51b60820d9dd24616025e03be40cd1050e1d92df7c5723669d1d6ff760ddff6

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 04:58

Target

e51b60820d9dd24616025e03be40cd1050e1d92df7c5723669d1d6ff760ddff6.exe
Size

78KB
MD5

108ffec0ee10f84cb1639feee2e39c98
SHA1

3b06200974b7b09261e5e5524fb582045201bba5
SHA256

e51b60820d9dd24616025e03be40cd1050e1d92df7c5723669d1d6ff760ddff6
SHA512

860351132da54bf093a83ff5f085c95df516a4b55366c11cd3a25076a78d797bee4bd4b7979fdd38e26b18db7a9c97c69a89d4960b773f8e88e7dbdacf239723
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+9mPIC:5Zv5PDwbjNrmAE+9CIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTMwNDg0MDIyNTk4NTY1ODkxMQ.GDZZ2z.lMwm1e_G-suZqGOYVjx4icZ38aZVNWK2N0ppjc
server_id
1304839152407281706

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2532	2268	e51b60820d9dd24616025e03be40cd1050e1d92df7c5723669d1d6ff760ddff6.exe	31
PID 2268 wrote to memory of 2532	2268	e51b60820d9dd24616025e03be40cd1050e1d92df7c5723669d1d6ff760ddff6.exe	31
PID 2268 wrote to memory of 2532	2268	e51b60820d9dd24616025e03be40cd1050e1d92df7c5723669d1d6ff760ddff6.exe	31

C:\Users\Admin\AppData\Local\Temp\e51b60820d9dd24616025e03be40cd1050e1d92df7c5723669d1d6ff760ddff6.exe
"C:\Users\Admin\AppData\Local\Temp\e51b60820d9dd24616025e03be40cd1050e1d92df7c5723669d1d6ff760ddff6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2268 -s 596
  2⤵
  PID:2532

memory/2268-0-0x000007FEF58E3000-0x000007FEF58E4000-memory.dmp

Filesize
4KB

Download
memory/2268-1-0x000000013FA80000-0x000000013FA98000-memory.dmp

Filesize
96KB

Download
memory/2268-2-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download
memory/2268-3-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download