discordrat | ae765e46bd2e0c5118ba0e265d0c1e2099174c0ae7ae73d13fb17d02c5f1ebe9

Analysis

max time kernel
15s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
27-11-2024 04:53

Target

ae765e46bd2e0c5118ba0e265d0c1e2099174c0ae7ae73d13fb17d02c5f1ebe9N.exe
Size

52KB
MD5

462e6693503b6c30c516808b8ccc3400
SHA1

29ad717ea467a84c1ddb7ed063ff5dde0e39ea87
SHA256

ae765e46bd2e0c5118ba0e265d0c1e2099174c0ae7ae73d13fb17d02c5f1ebe9
SHA512

159371370d5c207acfe40bc585b8f8d552fd7110e1f4685d10e01352d58da57e7ee42f379c35e267afca3d099aeaa06611284acd3770482d6ebd3107422d4539
SSDEEP

1536:vPRjIUGJl4exkgJEYq32vpeF3x9pjn9PDlJBV:vetFkM032C3x959PDJV

Score

10^/10

Family

discordrat

Attributes

discord_token
MTMwNzMxODc0NzQwNDU3MDY3OA.G-vi1p.JQJFkahsFQq102eFxb2BV6vjl-EvPlDrewQ78U
server_id
1305971531972608070

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2268	2328	ae765e46bd2e0c5118ba0e265d0c1e2099174c0ae7ae73d13fb17d02c5f1ebe9N.exe	30
PID 2328 wrote to memory of 2268	2328	ae765e46bd2e0c5118ba0e265d0c1e2099174c0ae7ae73d13fb17d02c5f1ebe9N.exe	30
PID 2328 wrote to memory of 2268	2328	ae765e46bd2e0c5118ba0e265d0c1e2099174c0ae7ae73d13fb17d02c5f1ebe9N.exe	30

C:\Users\Admin\AppData\Local\Temp\ae765e46bd2e0c5118ba0e265d0c1e2099174c0ae7ae73d13fb17d02c5f1ebe9N.exe
"C:\Users\Admin\AppData\Local\Temp\ae765e46bd2e0c5118ba0e265d0c1e2099174c0ae7ae73d13fb17d02c5f1ebe9N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2328 -s 560
  2⤵
  PID:2268

memory/2328-0-0x000007FEF58E3000-0x000007FEF58E4000-memory.dmp

Filesize
4KB

Download
memory/2328-1-0x000000013F120000-0x000000013F132000-memory.dmp

Filesize
72KB

Download
memory/2328-2-0x0000000000740000-0x0000000000758000-memory.dmp

Filesize
96KB

Download