discordrat | 3ed7928ecd92c3c2ff083203aef58d0ca7f9f0f73b29d907ca4bebbc28b88e20

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
05/12/2024, 02:38

Target

3ed7928ecd92c3c2ff083203aef58d0ca7f9f0f73b29d907ca4bebbc28b88e20N.exe
Size

90KB
MD5

1138f5b5ea3bddc1b50092eac4416b50
SHA1

f10a815e89bb0eab68cb7bc5c6aef7b0e2ce750e
SHA256

3ed7928ecd92c3c2ff083203aef58d0ca7f9f0f73b29d907ca4bebbc28b88e20
SHA512

76e5c1968ef655adfd5959ef5981d3c069ff390d34500f8eba771731a6394842bfe7c868c31be4b775c6dae6d524031d46b988e69aa2537fe7d54fab7a19d0c1
SSDEEP

1536:YbPjt72uOFmYskRPUAqtBTldwaIfpAk0Wjgb2NrI+uexCxoKV6+fvjS4:WjtyuOFpskpgBTlurRgb2NrI+bSvjS4

Score

10^/10

Family

discordrat

Attributes

discord_token
MTMwOTg4MDE2NTE2OTYzMTI1Mw.G_7Dxh.wsYSjBrol4khGDtnY_BBpyEe-H9AsmG2TfF5gs
server_id
1309880651683467275

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2672	2080	3ed7928ecd92c3c2ff083203aef58d0ca7f9f0f73b29d907ca4bebbc28b88e20N.exe	30
PID 2080 wrote to memory of 2672	2080	3ed7928ecd92c3c2ff083203aef58d0ca7f9f0f73b29d907ca4bebbc28b88e20N.exe	30
PID 2080 wrote to memory of 2672	2080	3ed7928ecd92c3c2ff083203aef58d0ca7f9f0f73b29d907ca4bebbc28b88e20N.exe	30

C:\Users\Admin\AppData\Local\Temp\3ed7928ecd92c3c2ff083203aef58d0ca7f9f0f73b29d907ca4bebbc28b88e20N.exe
"C:\Users\Admin\AppData\Local\Temp\3ed7928ecd92c3c2ff083203aef58d0ca7f9f0f73b29d907ca4bebbc28b88e20N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2080 -s 596
  2⤵
  PID:2672

memory/2080-0-0x000007FEF58E3000-0x000007FEF58E4000-memory.dmp

Filesize
4KB

Download
memory/2080-1-0x000000013F0E0000-0x000000013F0FC000-memory.dmp

Filesize
112KB

Download
memory/2080-2-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download
memory/2080-3-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download