discordrat | d10e77f707bba12467990038e51d6487fa14599632e6483ea486bd217e962e4e

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-12-2024 07:30

Target

Fixify.exe
Size

78KB
MD5

d3bf0f62d3f60d4bbaa2dc2679047771
SHA1

38fa28e1c555a9c74585b7a5782fc8f47a8e5c82
SHA256

d10e77f707bba12467990038e51d6487fa14599632e6483ea486bd217e962e4e
SHA512

cd30ee05e92927088402826b2c62b2afcd815c4b438d36d8c674c64aa433a53b9ae5e08745775a2ef3f56fb2ab03779194f9c1c0aed2b332faeb4704b8de4f41
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+pPIC:5Zv5PDwbjNrmAE+ZIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTIyOTM2NDE5NTk2Mzk2NTQ0MA.GKsTV5.gHldWdEuuiqssOANlb67Ra75xqTpvUkKG2fDSE
server_id
1226963401209810974

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Fixify.exe

description	pid	Process	procid_target
PID 2964 wrote to memory of 808	2964	Fixify.exe	28
PID 2964 wrote to memory of 808	2964	Fixify.exe	28
PID 2964 wrote to memory of 808	2964	Fixify.exe	28

C:\Users\Admin\AppData\Local\Temp\Fixify.exe
"C:\Users\Admin\AppData\Local\Temp\Fixify.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2964 -s 600
  2⤵
  PID:808

memory/2964-0-0x000007FEF5CF3000-0x000007FEF5CF4000-memory.dmp

Filesize
4KB

Download
memory/2964-1-0x000000013F330000-0x000000013F348000-memory.dmp

Filesize
96KB

Download
memory/2964-2-0x000007FEF5CF0000-0x000007FEF66DC000-memory.dmp

Filesize
9.9MB

Download
memory/2964-3-0x000007FEF5CF3000-0x000007FEF5CF4000-memory.dmp

Filesize
4KB

Download
memory/2964-4-0x000007FEF5CF0000-0x000007FEF66DC000-memory.dmp

Filesize
9.9MB

Download