discordrat | 8f9b1bf330055f79fc34aaba09f2a48d80618c72a14dfdb1e55aae3009b2b20b

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
02-12-2024 12:37

Target

8f9b1bf330055f79fc34aaba09f2a48d80618c72a14dfdb1e55aae3009b2b20bN.exe
Size

78KB
MD5

8347b337f53c96221d76bb64520d3780
SHA1

58006917449e9bc4a510a9fa075d1c396f387490
SHA256

8f9b1bf330055f79fc34aaba09f2a48d80618c72a14dfdb1e55aae3009b2b20b
SHA512

b7a73faecbb9b6088674530176375abb37ae0217433b2356fd513718b96db35b8b76dcd13f9bab3328a2f2aba571d63480e8e260d9ae2bc483bf4c381a1396b7
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+dPIC:5Zv5PDwbjNrmAE+NIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTMxMDc4MzM0NjUwNjIwNzI1Mw.GSNdLO.s8vWhLyqEn0Xi5FdCUXdE-U9CMVtJTPiyuuTBE
server_id
1311961479213355048

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

8f9b1bf330055f79fc34aaba09f2a48d80618c72a14dfdb1e55aae3009b2b20bN.exe

description	pid	Process	procid_target
PID 2488 wrote to memory of 1412	2488	8f9b1bf330055f79fc34aaba09f2a48d80618c72a14dfdb1e55aae3009b2b20bN.exe	31
PID 2488 wrote to memory of 1412	2488	8f9b1bf330055f79fc34aaba09f2a48d80618c72a14dfdb1e55aae3009b2b20bN.exe	31
PID 2488 wrote to memory of 1412	2488	8f9b1bf330055f79fc34aaba09f2a48d80618c72a14dfdb1e55aae3009b2b20bN.exe	31

C:\Users\Admin\AppData\Local\Temp\8f9b1bf330055f79fc34aaba09f2a48d80618c72a14dfdb1e55aae3009b2b20bN.exe
"C:\Users\Admin\AppData\Local\Temp\8f9b1bf330055f79fc34aaba09f2a48d80618c72a14dfdb1e55aae3009b2b20bN.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2488 -s 596
  2⤵
  PID:1412

memory/2488-0-0x000007FEF6063000-0x000007FEF6064000-memory.dmp

Filesize
4KB

Download
memory/2488-1-0x000000013F5D0000-0x000000013F5E8000-memory.dmp

Filesize
96KB

Download
memory/2488-2-0x000007FEF6060000-0x000007FEF6A4C000-memory.dmp

Filesize
9.9MB

Download
memory/2488-3-0x000007FEF6060000-0x000007FEF6A4C000-memory.dmp

Filesize
9.9MB

Download