discordrat | 86c03834c2a1470335f8312128a2f6de4c219a92c6dbc60b80eed7f76de7c08c

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
19-12-2024 23:32

Target

Discord rat.exe
Size

93KB
MD5

7f99f4ba0b14befa2a5a969e9dbc9bdb
SHA1

e9c09a67f39bf4ee6048f2dbd121a5066fc38cb2
SHA256

86c03834c2a1470335f8312128a2f6de4c219a92c6dbc60b80eed7f76de7c08c
SHA512

b8d40936c7677ee81fa0bacb5e154fac2834626c915eafecb8695c870b12f7b16ae56b2c22f504242625e0f995470d8d6dbf805c004fbf82cfe1f6e6f4982975
SSDEEP

1536:lJlpCd6WN8reCqcY5SCP7OtjCGlpbwxtxKkiXGBe6/bVVPrG+czxCxoKV6+UAs5d:l9Y5x76jR/bwxtxK/Gt/bVVPrG+0NAsv

Score

10^/10

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/2244-1-0x000000013FF40000-0x000000013FF5C000-memory.dmp	disable_win_def

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2972	2244	Discord rat.exe	30
PID 2244 wrote to memory of 2972	2244	Discord rat.exe	30
PID 2244 wrote to memory of 2972	2244	Discord rat.exe	30

C:\Users\Admin\AppData\Local\Temp\Discord rat.exe
"C:\Users\Admin\AppData\Local\Temp\Discord rat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2244 -s 584
  2⤵
  PID:2972

memory/2244-0-0x000007FEF5003000-0x000007FEF5004000-memory.dmp

Filesize
4KB

Download
memory/2244-1-0x000000013FF40000-0x000000013FF5C000-memory.dmp

Filesize
112KB

Download
memory/2244-2-0x000007FEF5000000-0x000007FEF59EC000-memory.dmp

Filesize
9.9MB

Download
memory/2244-4-0x000007FEF5000000-0x000007FEF59EC000-memory.dmp

Filesize
9.9MB

Download