discordrat | c00cf3f6a3dadd4c2843ac5a4d8179fa6fe1882e85e12ab342c375cf47305d8d

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-11-2024 04:22

Target

c00cf3f6a3dadd4c2843ac5a4d8179fa6fe1882e85e12ab342c375cf47305d8dN.exe
Size

78KB
MD5

c81810c90a98ff95dda36707a88e60c0
SHA1

d523856cf48f6a3bfdeb8310b8f76588e56b56cb
SHA256

c00cf3f6a3dadd4c2843ac5a4d8179fa6fe1882e85e12ab342c375cf47305d8d
SHA512

bc9c95fda34e91c39dc9e4eae015055a0b1fab5746386bb6dd3c906b5dc38545c0b9145c32a6763e4bbfc375d3cd15a99f6833882a98d61be6d98fd499b11ce7
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+zPIC:5Zv5PDwbjNrmAE+rIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTMwNDUyNjgyMjkzMDc3NjEzNQ.GwiOJr.rp47kAwqUW89XVZW2-vlwDd1DYTfbVY8fbo0r8
server_id
1304528345966444544

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2060	2108	c00cf3f6a3dadd4c2843ac5a4d8179fa6fe1882e85e12ab342c375cf47305d8dN.exe	30
PID 2108 wrote to memory of 2060	2108	c00cf3f6a3dadd4c2843ac5a4d8179fa6fe1882e85e12ab342c375cf47305d8dN.exe	30
PID 2108 wrote to memory of 2060	2108	c00cf3f6a3dadd4c2843ac5a4d8179fa6fe1882e85e12ab342c375cf47305d8dN.exe	30

C:\Users\Admin\AppData\Local\Temp\c00cf3f6a3dadd4c2843ac5a4d8179fa6fe1882e85e12ab342c375cf47305d8dN.exe
"C:\Users\Admin\AppData\Local\Temp\c00cf3f6a3dadd4c2843ac5a4d8179fa6fe1882e85e12ab342c375cf47305d8dN.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2108 -s 600
  2⤵
  PID:2060

memory/2108-0-0x000007FEF5E43000-0x000007FEF5E44000-memory.dmp

Filesize
4KB

Download
memory/2108-1-0x000000013F3E0000-0x000000013F3F8000-memory.dmp

Filesize
96KB

Download
memory/2108-2-0x000007FEF5E40000-0x000007FEF682C000-memory.dmp

Filesize
9.9MB

Download
memory/2108-3-0x000007FEF5E40000-0x000007FEF682C000-memory.dmp

Filesize
9.9MB

Download