discordrat | 75a5cc0ee3ad2ae84dedabdd148fc28265584f3fc97b7c05468d21ec4d3b81d0

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10-12-2024 19:21

Target

75a5cc0ee3ad2ae84dedabdd148fc28265584f3fc97b7c05468d21ec4d3b81d0N.exe
Size

78KB
MD5

6d79aee0dff284b1f98ebfb1b311ef10
SHA1

a34777287143eb38be26ce49f62f345ff76f9c7b
SHA256

75a5cc0ee3ad2ae84dedabdd148fc28265584f3fc97b7c05468d21ec4d3b81d0
SHA512

edf8d34b52b663d13da78924cc6bbf75648c70a835a3bb9fba33a75779adbedc2d0cb401e2156e15a0979b95bbc4f6f3cd51250955884caa17716cb68e23fb63
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+tPIC:5Zv5PDwbjNrmAE+9IC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTMxNDQwMjI2NzY1MDE5OTY0Mg.GJY-Qx.FOigqv8MqYoYnU9GcN78H2nn4LmOmkgDqu6EEQ
server_id
1310760753741041805

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 1328	1064	75a5cc0ee3ad2ae84dedabdd148fc28265584f3fc97b7c05468d21ec4d3b81d0N.exe	30
PID 1064 wrote to memory of 1328	1064	75a5cc0ee3ad2ae84dedabdd148fc28265584f3fc97b7c05468d21ec4d3b81d0N.exe	30
PID 1064 wrote to memory of 1328	1064	75a5cc0ee3ad2ae84dedabdd148fc28265584f3fc97b7c05468d21ec4d3b81d0N.exe	30

C:\Users\Admin\AppData\Local\Temp\75a5cc0ee3ad2ae84dedabdd148fc28265584f3fc97b7c05468d21ec4d3b81d0N.exe
"C:\Users\Admin\AppData\Local\Temp\75a5cc0ee3ad2ae84dedabdd148fc28265584f3fc97b7c05468d21ec4d3b81d0N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1064 -s 596
  2⤵
  PID:1328

memory/1064-0-0x000007FEF5403000-0x000007FEF5404000-memory.dmp

Filesize
4KB

Download
memory/1064-1-0x000000013F9B0000-0x000000013F9C8000-memory.dmp

Filesize
96KB

Download
memory/1064-2-0x000007FEF5400000-0x000007FEF5DEC000-memory.dmp

Filesize
9.9MB

Download
memory/1064-3-0x000007FEF5400000-0x000007FEF5DEC000-memory.dmp

Filesize
9.9MB

Download