discordrat | 3f1ff5dfe28c3aaecbdaf29ae23d9f26041797faad8fec1370a0e5a4fa9e7d5f

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-11-2024 16:29

Target

3f1ff5dfe28c3aaecbdaf29ae23d9f26041797faad8fec1370a0e5a4fa9e7d5f.exe
Size

52KB
MD5

d8f7b3eb5bab6660f66a0ce2ff23a29d
SHA1

a77f4b782abf7e214bbe08f5d6c7dad2465a5f4f
SHA256

3f1ff5dfe28c3aaecbdaf29ae23d9f26041797faad8fec1370a0e5a4fa9e7d5f
SHA512

1b350c0341b79174c3be26d0971e22a17c7644f12685916b3834318bc9400a74d55581b77458561ba1d81b772dbc5b54f50aea61c83bbb45dfb50cd54564b869
SSDEEP

1536:vPRjIUGJl4exkgJEYq32vpeF3x9pjn9PDlJBX:vetFkM032C3x959PDJX

Score

10^/10

Family

discordrat

Attributes

discord_token
MTMwNzMxODc0NzQwNDU3MDY3OA.G-vi1p.JQJFkahsFQq102eFxb2BV6vjl-EvPlDrewQ78U
server_id
1305971531972608070

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

3f1ff5dfe28c3aaecbdaf29ae23d9f26041797faad8fec1370a0e5a4fa9e7d5f.exe

description	pid	Process	procid_target
PID 2360 wrote to memory of 2124	2360	3f1ff5dfe28c3aaecbdaf29ae23d9f26041797faad8fec1370a0e5a4fa9e7d5f.exe	30
PID 2360 wrote to memory of 2124	2360	3f1ff5dfe28c3aaecbdaf29ae23d9f26041797faad8fec1370a0e5a4fa9e7d5f.exe	30
PID 2360 wrote to memory of 2124	2360	3f1ff5dfe28c3aaecbdaf29ae23d9f26041797faad8fec1370a0e5a4fa9e7d5f.exe	30

C:\Users\Admin\AppData\Local\Temp\3f1ff5dfe28c3aaecbdaf29ae23d9f26041797faad8fec1370a0e5a4fa9e7d5f.exe
"C:\Users\Admin\AppData\Local\Temp\3f1ff5dfe28c3aaecbdaf29ae23d9f26041797faad8fec1370a0e5a4fa9e7d5f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2360 -s 556
  2⤵
  PID:2124

memory/2360-0-0x000007FEF58D3000-0x000007FEF58D4000-memory.dmp

Filesize
4KB

Download
memory/2360-1-0x000000013FF50000-0x000000013FF62000-memory.dmp

Filesize
72KB

Download
memory/2360-2-0x0000000000540000-0x0000000000558000-memory.dmp

Filesize
96KB

Download