discordrat | 98ac7772969edb1cec6110cf07ecbd151f008d62373b6fe8b9099a0ad68bf2eb

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-12-2024 10:47

Target

libary.hpp.exe
Size

78KB
MD5

b59a3035631d7d9740f6bbeee9f9af7a
SHA1

63dd307c35e27216f00a5f915fc06c74b3124dd6
SHA256

98ac7772969edb1cec6110cf07ecbd151f008d62373b6fe8b9099a0ad68bf2eb
SHA512

8ac564658284976f614863b8a17faec37cdf014a9188bccdbe3e2e1ad806b7941c107269febad650c41bcfb31e75a8d324ebde7be449858f87841324aa050916
SSDEEP

1536:lIWOBaZ84c6gEz5De2FzNDnghTAsKFbOZGdndxRKDIZ8o1l8ApbDNr1+uexCxoKG:lIWOBaZ84c6gEz5De2FzNDnghTdWd7Kv

Score

10^/10

Family

discordrat

Attributes

discord_token
MTMxMzk0OTc0NTY1NTQ0NzY0Mw.GvqYM1.8ZwhOILcM3Ijsfbzqc8F-Cy7wfV5wKSv-BMD0I
server_id
1313949691574226985

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2280	2136	libary.hpp.exe	28
PID 2136 wrote to memory of 2280	2136	libary.hpp.exe	28
PID 2136 wrote to memory of 2280	2136	libary.hpp.exe	28

C:\Users\Admin\AppData\Local\Temp\libary.hpp.exe
"C:\Users\Admin\AppData\Local\Temp\libary.hpp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2136 -s 600
  2⤵
  PID:2280

memory/2136-0-0x000007FEF5B03000-0x000007FEF5B04000-memory.dmp

Filesize
4KB

Download
memory/2136-1-0x000000013F1C0000-0x000000013F1D8000-memory.dmp

Filesize
96KB

Download
memory/2136-2-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmp

Filesize
9.9MB

Download
memory/2136-3-0x000007FEF5B00000-0x000007FEF64EC000-memory.dmp

Filesize
9.9MB

Download