discordrat | 23bb32996f7d5e1f33ab05600c29642956edc6b262304035efab73f3b86feec9

Analysis

max time kernel
127s
max time network
122s
platform
windows7_x64
resource
win7-20241023-es
resource tags

arch:x64arch:x86image:win7-20241023-eslocale:es-esos:windows7-x64systemwindows
submitted
13-12-2024 18:47

Target

testpng.exe
Size

78KB
MD5

98f6e65be9a95b6a0ccf9a5aacf89de5
SHA1

6d4e66094d5e332457d62ed2b9910bc229240d58
SHA256

23bb32996f7d5e1f33ab05600c29642956edc6b262304035efab73f3b86feec9
SHA512

7f05f2dff4a20415ffcc9cd3c0fb2b74499aca9ab59f73817a66e68bcf74b9915c908f4b076abbf6083d4cd29d88e3c2e2f0cf855068b66e112444ec7949284e
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+ayPIC:5Zv5PDwbjNrmAE+a+IC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTMxNzE1MTMxMDMxMDY3NDQ1Mw.GmAoQR.n9xRqZURsT5g3LGTtKYNBSjio3XuQpmLH7RLO0
server_id
1317163923350487151

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 1848	2088	testpng.exe	30
PID 2088 wrote to memory of 1848	2088	testpng.exe	30
PID 2088 wrote to memory of 1848	2088	testpng.exe	30

C:\Users\Admin\AppData\Local\Temp\testpng.exe
"C:\Users\Admin\AppData\Local\Temp\testpng.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2088 -s 636
  2⤵
  PID:1848

memory/2088-0-0x000007FEF5373000-0x000007FEF5374000-memory.dmp

Filesize
4KB

Download
memory/2088-1-0x000000013F550000-0x000000013F568000-memory.dmp

Filesize
96KB

Download
memory/2088-2-0x000007FEF5370000-0x000007FEF5D5C000-memory.dmp

Filesize
9.9MB

Download
memory/2088-3-0x000007FEF5373000-0x000007FEF5374000-memory.dmp

Filesize
4KB

Download
memory/2088-4-0x000007FEF5370000-0x000007FEF5D5C000-memory.dmp

Filesize
9.9MB

Download
memory/2088-5-0x000007FEF5370000-0x000007FEF5D5C000-memory.dmp

Filesize
9.9MB

Download