discordrat | 1f3b8599d811004b6d52d543e451555944c3c4dc2893d04a370a0874e99c82af

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-11-2024 13:52

Target

Discordrat.exe
Size

90KB
MD5

d74728a955861daf303ff42c7f572d16
SHA1

a73b4d871a4caec1700349de9b5f7dbf4ba59f7b
SHA256

1f3b8599d811004b6d52d543e451555944c3c4dc2893d04a370a0874e99c82af
SHA512

73c271de7061e53b91079636d99f1967ce922bf47c14539569b2f0f3a9b6628bc4cc1fd9a7d7cb1e10bdfc95c8ce49e0a0f3a815cf5810f44a5c2b35ba116e69
SSDEEP

1536:ibPjt72uOFmYskRPUAqtBTldwX0bpAkAfLgbGNrk+uexCxoKV6+fEX85:EjtyuOFpskpgBTlukQgbGNrk+bSEXQ

Score

10^/10

Family

discordrat

Attributes

discord_token
MTMwOTg3NTA0MzA1MTg5Njk1NA.GTR-3U.C7tazMXoRaSR--tVDMbQdoDKBw2f8bLXItZIRo
server_id
1309876526615101530

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Discordrat.exe

description	pid	Process	procid_target
PID 2364 wrote to memory of 1908	2364	Discordrat.exe	30
PID 2364 wrote to memory of 1908	2364	Discordrat.exe	30
PID 2364 wrote to memory of 1908	2364	Discordrat.exe	30

C:\Users\Admin\AppData\Local\Temp\Discordrat.exe
"C:\Users\Admin\AppData\Local\Temp\Discordrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2364 -s 596
  2⤵
  PID:1908

memory/2364-0-0x000007FEF59A3000-0x000007FEF59A4000-memory.dmp

Filesize
4KB

Download
memory/2364-1-0x000000013F150000-0x000000013F16C000-memory.dmp

Filesize
112KB

Download
memory/2364-2-0x000007FEF59A0000-0x000007FEF638C000-memory.dmp

Filesize
9.9MB

Download
memory/2364-3-0x000007FEF59A0000-0x000007FEF638C000-memory.dmp

Filesize
9.9MB

Download