discordrat | 3ed7928ecd92c3c2ff083203aef58d0ca7f9f0f73b29d907ca4bebbc28b88e20

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 08:22

Target

3ed7928ecd92c3c2ff083203aef58d0ca7f9f0f73b29d907ca4bebbc28b88e20.exe
Size

90KB
MD5

1138f5b5ea3bddc1b50092eac4416b50
SHA1

f10a815e89bb0eab68cb7bc5c6aef7b0e2ce750e
SHA256

3ed7928ecd92c3c2ff083203aef58d0ca7f9f0f73b29d907ca4bebbc28b88e20
SHA512

76e5c1968ef655adfd5959ef5981d3c069ff390d34500f8eba771731a6394842bfe7c868c31be4b775c6dae6d524031d46b988e69aa2537fe7d54fab7a19d0c1
SSDEEP

1536:YbPjt72uOFmYskRPUAqtBTldwaIfpAk0Wjgb2NrI+uexCxoKV6+fvjS4:WjtyuOFpskpgBTlurRgb2NrI+bSvjS4

Score

10^/10

Family

discordrat

Attributes

discord_token
MTMwOTg4MDE2NTE2OTYzMTI1Mw.G_7Dxh.wsYSjBrol4khGDtnY_BBpyEe-H9AsmG2TfF5gs
server_id
1309880651683467275

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

3ed7928ecd92c3c2ff083203aef58d0ca7f9f0f73b29d907ca4bebbc28b88e20.exe

description	pid	Process	procid_target
PID 1672 wrote to memory of 1272	1672	3ed7928ecd92c3c2ff083203aef58d0ca7f9f0f73b29d907ca4bebbc28b88e20.exe	28
PID 1672 wrote to memory of 1272	1672	3ed7928ecd92c3c2ff083203aef58d0ca7f9f0f73b29d907ca4bebbc28b88e20.exe	28
PID 1672 wrote to memory of 1272	1672	3ed7928ecd92c3c2ff083203aef58d0ca7f9f0f73b29d907ca4bebbc28b88e20.exe	28

C:\Users\Admin\AppData\Local\Temp\3ed7928ecd92c3c2ff083203aef58d0ca7f9f0f73b29d907ca4bebbc28b88e20.exe
"C:\Users\Admin\AppData\Local\Temp\3ed7928ecd92c3c2ff083203aef58d0ca7f9f0f73b29d907ca4bebbc28b88e20.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1672 -s 596
  2⤵
  PID:1272

memory/1672-0-0x000007FEF55E3000-0x000007FEF55E4000-memory.dmp

Filesize
4KB

Download
memory/1672-1-0x000000013F6D0000-0x000000013F6EC000-memory.dmp

Filesize
112KB

Download
memory/1672-2-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp

Filesize
9.9MB

Download
memory/1672-3-0x000007FEF55E0000-0x000007FEF5FCC000-memory.dmp

Filesize
9.9MB

Download