discordrat | cc621821d4881c5d707967d21ffee75d174f32a74eb07f29d1ce9d123cb6d2dc

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 11:04

Target

cc621821d4881c5d707967d21ffee75d174f32a74eb07f29d1ce9d123cb6d2dcN.exe
Size

52KB
MD5

084ea26ce9c5c888df203a5d229605c0
SHA1

2a6cebfb5ba8887a254343df3bd563b9de86b54e
SHA256

cc621821d4881c5d707967d21ffee75d174f32a74eb07f29d1ce9d123cb6d2dc
SHA512

f69de1c7349e622d6bc73049ac3cc922a18280fff61f3cec9b929809ba8f4bc9e00dd8ae68f8e2ac698599c348d340ea27d91c896daa818f35f3abfc477063a2
SSDEEP

1536:vPRjIUGJl4exkgJEYq32vpeF3x9pjn9PDlJB:vetFkM032C3x959PDJ

Score

10^/10

Family

discordrat

Attributes

discord_token
MTMwNzMxODc0NzQwNDU3MDY3OA.G-vi1p.JQJFkahsFQq102eFxb2BV6vjl-EvPlDrewQ78U
server_id
1305971531972608070

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cc621821d4881c5d707967d21ffee75d174f32a74eb07f29d1ce9d123cb6d2dcN.exe

description	pid	process	target process
PID 2084 wrote to memory of 2372	2084	cc621821d4881c5d707967d21ffee75d174f32a74eb07f29d1ce9d123cb6d2dcN.exe	WerFault.exe
PID 2084 wrote to memory of 2372	2084	cc621821d4881c5d707967d21ffee75d174f32a74eb07f29d1ce9d123cb6d2dcN.exe	WerFault.exe
PID 2084 wrote to memory of 2372	2084	cc621821d4881c5d707967d21ffee75d174f32a74eb07f29d1ce9d123cb6d2dcN.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\cc621821d4881c5d707967d21ffee75d174f32a74eb07f29d1ce9d123cb6d2dcN.exe
"C:\Users\Admin\AppData\Local\Temp\cc621821d4881c5d707967d21ffee75d174f32a74eb07f29d1ce9d123cb6d2dcN.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2084 -s 556
  2⤵
  PID:2372

memory/2084-0-0x000007FEF5A03000-0x000007FEF5A04000-memory.dmp

Filesize
4KB

Download
memory/2084-1-0x000000013FA50000-0x000000013FA62000-memory.dmp

Filesize
72KB

Download
memory/2084-2-0x0000000000650000-0x0000000000668000-memory.dmp

Filesize
96KB

Download