discordrat | a87ddea0278eb85a96f1efb2537253cc29973c6890aed5e131c338ea1ab4234a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-12-2024 23:28

Target

Discord rat.exe
Size

94KB
MD5

1d7b0de85699084d7a881eb719c03eae
SHA1

878d9bca92765774ca22bfb6999f4fd8c2a916aa
SHA256

a87ddea0278eb85a96f1efb2537253cc29973c6890aed5e131c338ea1ab4234a
SHA512

e5390cd57cd4fe48d913b5bd1f7b770c96fdb318da76ecac5500562b892d786367def2e92bd2523c55b026014e840bebaa393ed81a485e1608ee5c1050befaa8
SSDEEP

1536:56BxWNm6REP+bp/csCi7OFZeAqbd6btyRe46xbVXPrG+czxCxoKV6+UhUcw9:5vcK7+Zj/txbVXPrG+0NhUcg

Score

10^/10

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/2112-1-0x000000013FEF0000-0x000000013FF0C000-memory.dmp	disable_win_def

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2832	2112	Discord rat.exe	31
PID 2112 wrote to memory of 2832	2112	Discord rat.exe	31
PID 2112 wrote to memory of 2832	2112	Discord rat.exe	31

C:\Users\Admin\AppData\Local\Temp\Discord rat.exe
"C:\Users\Admin\AppData\Local\Temp\Discord rat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2112 -s 596
  2⤵
  PID:2832

memory/2112-0-0x000007FEF6623000-0x000007FEF6624000-memory.dmp

Filesize
4KB

Download
memory/2112-1-0x000000013FEF0000-0x000000013FF0C000-memory.dmp

Filesize
112KB

Download
memory/2112-2-0x000007FEF6620000-0x000007FEF700C000-memory.dmp

Filesize
9.9MB

Download
memory/2112-3-0x000007FEF6620000-0x000007FEF700C000-memory.dmp

Filesize
9.9MB

Download