discordrat | a766923ebb53cbff64f0603af9f07a4a5076aeff4d3416b7c817905a1a1c0a3f

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-12-2024 03:07

Target

a766923ebb53cbff64f0603af9f07a4a5076aeff4d3416b7c817905a1a1c0a3f.exe
Size

78KB
MD5

6c7dfceb22fe0ef78835f29e53ae6b3e
SHA1

c8b290b0ec67a3cadfa6766cf1e630414c1c61c1
SHA256

a766923ebb53cbff64f0603af9f07a4a5076aeff4d3416b7c817905a1a1c0a3f
SHA512

a506c076fe1b06c873aee2ebad22e953c3e0cf766736fa05f66f60031f7f7184c4d81e033f7787dfd1e007ec1feed88717a900fb76acb9fd42b8294807ef2964
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+8PIC:5Zv5PDwbjNrmAE+wIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTE1ODQ5NzkyODQ2MjIwNTExOQ.GRJ0l6.7SpFGKSu5G_J8dWAJje9hfCtSecIS6RuVXIE_E
server_id
1153564868197236846

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 2668	2948	a766923ebb53cbff64f0603af9f07a4a5076aeff4d3416b7c817905a1a1c0a3f.exe	30
PID 2948 wrote to memory of 2668	2948	a766923ebb53cbff64f0603af9f07a4a5076aeff4d3416b7c817905a1a1c0a3f.exe	30
PID 2948 wrote to memory of 2668	2948	a766923ebb53cbff64f0603af9f07a4a5076aeff4d3416b7c817905a1a1c0a3f.exe	30

C:\Users\Admin\AppData\Local\Temp\a766923ebb53cbff64f0603af9f07a4a5076aeff4d3416b7c817905a1a1c0a3f.exe
"C:\Users\Admin\AppData\Local\Temp\a766923ebb53cbff64f0603af9f07a4a5076aeff4d3416b7c817905a1a1c0a3f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2948 -s 596
  2⤵
  PID:2668

memory/2948-0-0x000007FEF5783000-0x000007FEF5784000-memory.dmp

Filesize
4KB

Download
memory/2948-1-0x000000013F030000-0x000000013F048000-memory.dmp

Filesize
96KB

Download
memory/2948-2-0x000007FEF5780000-0x000007FEF616C000-memory.dmp

Filesize
9.9MB

Download
memory/2948-3-0x000007FEF5780000-0x000007FEF616C000-memory.dmp

Filesize
9.9MB

Download