discordrat | d0621510b18f375b77b600cfc636804ae97052b27e87c16b4269c3725a46f2de

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-12-2024 03:36

Target

d0621510b18f375b77b600cfc636804ae97052b27e87c16b4269c3725a46f2deN.exe
Size

78KB
MD5

ca93d6f337d263a00063771e97805630
SHA1

026242874a51858d662277e72e4ffc312b97adb7
SHA256

d0621510b18f375b77b600cfc636804ae97052b27e87c16b4269c3725a46f2de
SHA512

3d859365a423a58c5f1dcd3c9517fa31ec508f25d6ab4a1eff4302a09b7547e65184ff8fd4e092dd2af0c86a47189fb64cb9796f66f7849e30241b9d89fc52a5
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+sPIC:5Zv5PDwbjNrmAE+AIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTIyNDc1OTk0MjMxODEyOTIzMw.Gz9uGb.wx8CPvYFOhJ1PZtR5rQeXTQjzkEGdhAAgN10rc
server_id
977774990676095038

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2396	1720	d0621510b18f375b77b600cfc636804ae97052b27e87c16b4269c3725a46f2deN.exe	30
PID 1720 wrote to memory of 2396	1720	d0621510b18f375b77b600cfc636804ae97052b27e87c16b4269c3725a46f2deN.exe	30
PID 1720 wrote to memory of 2396	1720	d0621510b18f375b77b600cfc636804ae97052b27e87c16b4269c3725a46f2deN.exe	30

C:\Users\Admin\AppData\Local\Temp\d0621510b18f375b77b600cfc636804ae97052b27e87c16b4269c3725a46f2deN.exe
"C:\Users\Admin\AppData\Local\Temp\d0621510b18f375b77b600cfc636804ae97052b27e87c16b4269c3725a46f2deN.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1720 -s 596
  2⤵
  PID:2396

memory/1720-0-0x000007FEF5973000-0x000007FEF5974000-memory.dmp

Filesize
4KB

Download
memory/1720-1-0x000000013FF00000-0x000000013FF18000-memory.dmp

Filesize
96KB

Download
memory/1720-2-0x000007FEF5970000-0x000007FEF635C000-memory.dmp

Filesize
9.9MB

Download
memory/1720-3-0x000007FEF5970000-0x000007FEF635C000-memory.dmp

Filesize
9.9MB

Download