discordrat | 3ed7928ecd92c3c2ff083203aef58d0ca7f9f0f73b29d907ca4bebbc28b88e20

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 08:19

Target

3ed7928ecd92c3c2ff083203aef58d0ca7f9f0f73b29d907ca4bebbc28b88e20.exe
Size

90KB
MD5

1138f5b5ea3bddc1b50092eac4416b50
SHA1

f10a815e89bb0eab68cb7bc5c6aef7b0e2ce750e
SHA256

3ed7928ecd92c3c2ff083203aef58d0ca7f9f0f73b29d907ca4bebbc28b88e20
SHA512

76e5c1968ef655adfd5959ef5981d3c069ff390d34500f8eba771731a6394842bfe7c868c31be4b775c6dae6d524031d46b988e69aa2537fe7d54fab7a19d0c1
SSDEEP

1536:YbPjt72uOFmYskRPUAqtBTldwaIfpAk0Wjgb2NrI+uexCxoKV6+fvjS4:WjtyuOFpskpgBTlurRgb2NrI+bSvjS4

Score

10^/10

Family

discordrat

Attributes

discord_token
MTMwOTg4MDE2NTE2OTYzMTI1Mw.G_7Dxh.wsYSjBrol4khGDtnY_BBpyEe-H9AsmG2TfF5gs
server_id
1309880651683467275

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

3ed7928ecd92c3c2ff083203aef58d0ca7f9f0f73b29d907ca4bebbc28b88e20.exe

description	pid	Process	procid_target
PID 2924 wrote to memory of 2412	2924	3ed7928ecd92c3c2ff083203aef58d0ca7f9f0f73b29d907ca4bebbc28b88e20.exe	31
PID 2924 wrote to memory of 2412	2924	3ed7928ecd92c3c2ff083203aef58d0ca7f9f0f73b29d907ca4bebbc28b88e20.exe	31
PID 2924 wrote to memory of 2412	2924	3ed7928ecd92c3c2ff083203aef58d0ca7f9f0f73b29d907ca4bebbc28b88e20.exe	31

C:\Users\Admin\AppData\Local\Temp\3ed7928ecd92c3c2ff083203aef58d0ca7f9f0f73b29d907ca4bebbc28b88e20.exe
"C:\Users\Admin\AppData\Local\Temp\3ed7928ecd92c3c2ff083203aef58d0ca7f9f0f73b29d907ca4bebbc28b88e20.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2924 -s 600
  2⤵
  PID:2412

memory/2924-0-0x000007FEF6163000-0x000007FEF6164000-memory.dmp

Filesize
4KB

Download
memory/2924-1-0x000000013F240000-0x000000013F25C000-memory.dmp

Filesize
112KB

Download
memory/2924-2-0x000007FEF6160000-0x000007FEF6B4C000-memory.dmp

Filesize
9.9MB

Download
memory/2924-3-0x000007FEF6160000-0x000007FEF6B4C000-memory.dmp

Filesize
9.9MB

Download