discordrat | 7798b65fe0e0be5fee784b3bd142730b18915eaf9ea0bddef4f4ac4c44319362

Analysis

max time kernel
82s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-12-2024 19:29

Target

7798b65fe0e0be5fee784b3bd142730b18915eaf9ea0bddef4f4ac4c44319362.exe
Size

90KB
MD5

cb0d754bfde46f746e19728d9c56972e
SHA1

a8a9b0651c5cc4a1a406c3ee5e09e4b7f45b0469
SHA256

7798b65fe0e0be5fee784b3bd142730b18915eaf9ea0bddef4f4ac4c44319362
SHA512

28be1f4e53e61c1d610406c4da23ebd5a1b79c6f9a427492f757063dd139e7f9da9582787239a65ec04ca986f742adad85c55a8783b5d166b47cd3f20bd92e9c
SSDEEP

1536:YbPjt72uOFmYskRPUAqtBTldwaIfpAk0Wjgb2NrI+uexCxoKV6+fvjS4:WjtyuOFpskpgBTlurRgb2NrI+bSvjS4

Score

10^/10

Family

discordrat

Attributes

discord_token
MTMwOTg4MDE2NTE2OTYzMTI1Mw.G_7Dxh.wsYSjBrol4khGDtnY_BBpyEe-H9AsmG2TfF5gs
server_id
1309880651683467275

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2060	1672	7798b65fe0e0be5fee784b3bd142730b18915eaf9ea0bddef4f4ac4c44319362.exe	31
PID 1672 wrote to memory of 2060	1672	7798b65fe0e0be5fee784b3bd142730b18915eaf9ea0bddef4f4ac4c44319362.exe	31
PID 1672 wrote to memory of 2060	1672	7798b65fe0e0be5fee784b3bd142730b18915eaf9ea0bddef4f4ac4c44319362.exe	31

C:\Users\Admin\AppData\Local\Temp\7798b65fe0e0be5fee784b3bd142730b18915eaf9ea0bddef4f4ac4c44319362.exe
"C:\Users\Admin\AppData\Local\Temp\7798b65fe0e0be5fee784b3bd142730b18915eaf9ea0bddef4f4ac4c44319362.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1672 -s 600
  2⤵
  PID:2060

memory/1672-0-0x000007FEF5623000-0x000007FEF5624000-memory.dmp

Filesize
4KB

Download
memory/1672-1-0x000000013F620000-0x000000013F63C000-memory.dmp

Filesize
112KB

Download
memory/1672-2-0x000007FEF5620000-0x000007FEF600C000-memory.dmp

Filesize
9.9MB

Download
memory/1672-3-0x000007FEF5620000-0x000007FEF600C000-memory.dmp

Filesize
9.9MB

Download