discordrat | 86bbe1727249f6583be9658d2d68c7eee7635c0d68facde070c82a38dfe09c31

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/12/2024, 17:55

Target

black spigga nigga kys.exe
Size

91KB
MD5

ea02e55219234d84f7edc015efd376ea
SHA1

9c1f4fcdda3890009d1301b34e61cf6d94bd91c6
SHA256

86bbe1727249f6583be9658d2d68c7eee7635c0d68facde070c82a38dfe09c31
SHA512

a938a62d9af850e2ce35f3f59841b0cae59e28fafbff69fa00bdd39b73a265801dc0bd39705a2526d06ce7d2c45bd3c026820a35e72d9b1314752b1905e66f24
SSDEEP

1536:oXKQ2FNJQ4FLHv1xCtRE9PLlX/k0SbIANrNaI+uexCxoKV6+f9ExR:XQsDQ4FLHKTE9D5/ZSbIANrNN+bS92

Score

10^/10

Family

discordrat

Attributes

discord_token
AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAANkquobZQzEeoYHKoo4wB7AAAAAACAAAAAAAQZgAAAAEAACAAAAAoHOqVS9hOk58AbMxXOKMarWaWwwr5CC686pGFO0yAggAAAAAOgAAAAAIAACAAAABc9P9yem6CvWls70HVPxmbH0CUImLo2OEJpoTgHM7w1lAAAABBMpQbAvfC4PBd5+N0VsQqf8vXM3rhQ0s62GRBZZhHyHp9tvzssvGMkXjKCfOmjMdzc2PR7JEjzDPoxEN1UTHHxlLx6GrG47y5CIvn9a3g1UAAAABX9O1/x01YZkA+t0aLF8hAzujj9h+IGUGacXxMRcKHIwzS4qste5a9G5mDL/CUbPaTub2hMUnAkTwVQyGcko6o
server_id
1314287414537093211

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 2752	2744	black spigga nigga kys.exe	31
PID 2744 wrote to memory of 2752	2744	black spigga nigga kys.exe	31
PID 2744 wrote to memory of 2752	2744	black spigga nigga kys.exe	31

C:\Users\Admin\AppData\Local\Temp\black spigga nigga kys.exe
"C:\Users\Admin\AppData\Local\Temp\black spigga nigga kys.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2744 -s 532
  2⤵
  PID:2752

memory/2744-0-0x000007FEF61F3000-0x000007FEF61F4000-memory.dmp

Filesize
4KB

Download
memory/2744-1-0x000000013FE50000-0x000000013FE6C000-memory.dmp

Filesize
112KB

Download