discordrat | 57324656a109baebb74108a425c78e8e5e7f6ebafc5bc3a80fc44d5b99254fde

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/12/2024, 17:48

Target

Temp Spoofer.exe
Size

78KB
MD5

358de6b4fccfc3039bfcf59625a3e222
SHA1

85ab66a8921277e1d0b1e0dbca3533271be3ad15
SHA256

57324656a109baebb74108a425c78e8e5e7f6ebafc5bc3a80fc44d5b99254fde
SHA512

deee1a31ca915e95a2d095351cbf446866e3c18e052a4b7f044c1f558ca1e98f6c1a9e7a8036a0170054cb83eb2600edd83cfcfaaf19fc426094b4f0fd3b3528
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+7PIC:5Zv5PDwbjNrmAE+zIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTMxNTQ2NTY5MjY3MzQ3NDU5MQ.GPCiva.NkgczXS_PO9CFhqsuo2E4X4CaiS_1xP6NAtBb4
server_id
1315462772368085103

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2972	2536	Temp Spoofer.exe	30
PID 2536 wrote to memory of 2972	2536	Temp Spoofer.exe	30
PID 2536 wrote to memory of 2972	2536	Temp Spoofer.exe	30

C:\Users\Admin\AppData\Local\Temp\Temp Spoofer.exe
"C:\Users\Admin\AppData\Local\Temp\Temp Spoofer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2536 -s 596
  2⤵
  PID:2972

memory/2536-0-0x000007FEF56B3000-0x000007FEF56B4000-memory.dmp

Filesize
4KB

Download
memory/2536-1-0x000000013F900000-0x000000013F918000-memory.dmp

Filesize
96KB

Download
memory/2536-2-0x000007FEF56B0000-0x000007FEF609C000-memory.dmp

Filesize
9.9MB

Download
memory/2536-3-0x000007FEF56B3000-0x000007FEF56B4000-memory.dmp

Filesize
4KB

Download
memory/2536-4-0x000007FEF56B0000-0x000007FEF609C000-memory.dmp

Filesize
9.9MB

Download
memory/2536-5-0x000007FEF56B0000-0x000007FEF609C000-memory.dmp

Filesize
9.9MB

Download