discordrat | 189363b4c4cd0d4c9b4dd7c20177dc0eec8942dbf164aa8c6ca1227e6ff0f051

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-12-2024 20:09

Target

189363b4c4cd0d4c9b4dd7c20177dc0eec8942dbf164aa8c6ca1227e6ff0f051.exe
Size

78KB
MD5

7df646d7e240335e6521ee91d890ec4f
SHA1

cf40fc9613f998b812bebb8e2ef92d197c2bc290
SHA256

189363b4c4cd0d4c9b4dd7c20177dc0eec8942dbf164aa8c6ca1227e6ff0f051
SHA512

a054a08de1a599788156e2bbb6fd9dd8132a517ac683a4da54ed5d54fc64f0f3e72d810b5ec196ff12b9cd2993a0448fd97d6c791a804a825a92e19aa1e0a385
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+uPIC:5Zv5PDwbjNrmAE+KIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTMyMTE2Mzk1MTU5NzE1ODQ4MA.GATWmz.qBhTuxTj7H-lFM4Qiw6R3YKhhhQWW7_MiEQ3Yo
server_id
1321164622329544734

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2704	2232	189363b4c4cd0d4c9b4dd7c20177dc0eec8942dbf164aa8c6ca1227e6ff0f051.exe	30
PID 2232 wrote to memory of 2704	2232	189363b4c4cd0d4c9b4dd7c20177dc0eec8942dbf164aa8c6ca1227e6ff0f051.exe	30
PID 2232 wrote to memory of 2704	2232	189363b4c4cd0d4c9b4dd7c20177dc0eec8942dbf164aa8c6ca1227e6ff0f051.exe	30

C:\Users\Admin\AppData\Local\Temp\189363b4c4cd0d4c9b4dd7c20177dc0eec8942dbf164aa8c6ca1227e6ff0f051.exe
"C:\Users\Admin\AppData\Local\Temp\189363b4c4cd0d4c9b4dd7c20177dc0eec8942dbf164aa8c6ca1227e6ff0f051.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2232 -s 600
  2⤵
  PID:2704

memory/2232-0-0x000007FEF5E23000-0x000007FEF5E24000-memory.dmp

Filesize
4KB

Download
memory/2232-1-0x000000013F860000-0x000000013F878000-memory.dmp

Filesize
96KB

Download
memory/2232-2-0x000007FEF5E20000-0x000007FEF680C000-memory.dmp

Filesize
9.9MB

Download
memory/2232-3-0x000007FEF5E20000-0x000007FEF680C000-memory.dmp

Filesize
9.9MB

Download