discordrat | 111999bbdab75a8ff3ccd47003dc9bd8dec2a24af92a951df21875b279d5c2fe

Analysis

max time kernel
94s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-11-2024 05:30

Target

111999bbdab75a8ff3ccd47003dc9bd8dec2a24af92a951df21875b279d5c2fe.exe
Size

78KB
MD5

ba367ad3c65823bc1f06c7ecda566774
SHA1

b8cd601ea0b38286d156f3488b84c29e3f5ab09f
SHA256

111999bbdab75a8ff3ccd47003dc9bd8dec2a24af92a951df21875b279d5c2fe
SHA512

97fdc8c395a9c6b5450267e0046179beacbfa0426d8b908f63cdedeec0908042299493ff8ab9e386b1cfc3abcabd1bfeaf5ee2ce209b946fb95585c271fa92e5
SSDEEP

1536:p2WjO8XeEXF15P7v88wbjNrfxCXhRoKV6+V+mPICz:pZb5PDwbjNrmAE+CICz

Score

10^/10

Family

discordrat

Attributes

discord_token
MTMwOTg3MTc5NzI4MTM2MTk3Mg.GhQ_xq.SfTmNOBmZh2cFpfeGk4vYIgovJzeWEe9FK3B1s
server_id
https://discord.com/channels/1263224566717878413/1271484445240590336

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 604 wrote to memory of 316	604	111999bbdab75a8ff3ccd47003dc9bd8dec2a24af92a951df21875b279d5c2fe.exe	31
PID 604 wrote to memory of 316	604	111999bbdab75a8ff3ccd47003dc9bd8dec2a24af92a951df21875b279d5c2fe.exe	31
PID 604 wrote to memory of 316	604	111999bbdab75a8ff3ccd47003dc9bd8dec2a24af92a951df21875b279d5c2fe.exe	31

C:\Users\Admin\AppData\Local\Temp\111999bbdab75a8ff3ccd47003dc9bd8dec2a24af92a951df21875b279d5c2fe.exe
"C:\Users\Admin\AppData\Local\Temp\111999bbdab75a8ff3ccd47003dc9bd8dec2a24af92a951df21875b279d5c2fe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:604
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 604 -s 596
  2⤵
  PID:316

memory/604-0-0x000007FEF55F3000-0x000007FEF55F4000-memory.dmp

Filesize
4KB

Download
memory/604-1-0x000000013FE90000-0x000000013FEA8000-memory.dmp

Filesize
96KB

Download
memory/604-2-0x000007FEF55F0000-0x000007FEF5FDC000-memory.dmp

Filesize
9.9MB

Download
memory/604-3-0x000007FEF55F0000-0x000007FEF5FDC000-memory.dmp

Filesize
9.9MB

Download