discordrat | 2c41808826974a0fdd3c7b27850143cad077a79e0cf69c011da495d6abee679a

Resubmissions

24-11-2024 19:42

24-11-2024 09:24

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
24-11-2024 09:24

Target

Discordrat.exe
Size

90KB
MD5

d74728a955861daf303ff42c7f572d16
SHA1

a73b4d871a4caec1700349de9b5f7dbf4ba59f7b
SHA256

1f3b8599d811004b6d52d543e451555944c3c4dc2893d04a370a0874e99c82af
SHA512

73c271de7061e53b91079636d99f1967ce922bf47c14539569b2f0f3a9b6628bc4cc1fd9a7d7cb1e10bdfc95c8ce49e0a0f3a815cf5810f44a5c2b35ba116e69
SSDEEP

1536:ibPjt72uOFmYskRPUAqtBTldwX0bpAkAfLgbGNrk+uexCxoKV6+fEX85:EjtyuOFpskpgBTlukQgbGNrk+bSEXQ

Score

10^/10

Family

discordrat

Attributes

discord_token
MTMwOTg3NTA0MzA1MTg5Njk1NA.GTR-3U.C7tazMXoRaSR--tVDMbQdoDKBw2f8bLXItZIRo
server_id
1309876526615101530

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2804	3044	Discordrat.exe	30
PID 3044 wrote to memory of 2804	3044	Discordrat.exe	30
PID 3044 wrote to memory of 2804	3044	Discordrat.exe	30

C:\Users\Admin\AppData\Local\Temp\Discordrat.exe
"C:\Users\Admin\AppData\Local\Temp\Discordrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3044 -s 596
  2⤵
  PID:2804

memory/3044-0-0x000007FEF5EF3000-0x000007FEF5EF4000-memory.dmp

Filesize
4KB

Download
memory/3044-1-0x000000013FD90000-0x000000013FDAC000-memory.dmp

Filesize
112KB

Download
memory/3044-2-0x000007FEF5EF0000-0x000007FEF68DC000-memory.dmp

Filesize
9.9MB

Download
memory/3044-3-0x000007FEF5EF0000-0x000007FEF68DC000-memory.dmp

Filesize
9.9MB

Download