discordrat | 93116035b10bd4cf097072afe01726cc96aab25217fe3b25f31a165e108d53d5

Analysis

max time kernel
119s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31-12-2024 23:45

Target

93116035b10bd4cf097072afe01726cc96aab25217fe3b25f31a165e108d53d5N.exe
Size

78KB
MD5

beba2f1860361f908071ae0480886c50
SHA1

d50de03dabbe5a9cd3fd9baa102d5bd34bf86753
SHA256

93116035b10bd4cf097072afe01726cc96aab25217fe3b25f31a165e108d53d5
SHA512

d4944c7befd079717343cb4bb2a39f6e8d9d8c7fc6d660b67ea95534b4bf268104d0fce60091f9eb9bd236831ef8fadbc8abbaa4702b42bc072e256f84f99d60
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+CPIC:5Zv5PDwbjNrmAE+uIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTMyMTAyNDgwMDY1MDU2MzU5NA.G1Lkaa.Rjv16HjyLqgc3OurSWxyZU3Hp-XIFxeGWV8AsI
server_id
1321017162042966038

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2772	1668	93116035b10bd4cf097072afe01726cc96aab25217fe3b25f31a165e108d53d5N.exe	31
PID 1668 wrote to memory of 2772	1668	93116035b10bd4cf097072afe01726cc96aab25217fe3b25f31a165e108d53d5N.exe	31
PID 1668 wrote to memory of 2772	1668	93116035b10bd4cf097072afe01726cc96aab25217fe3b25f31a165e108d53d5N.exe	31

C:\Users\Admin\AppData\Local\Temp\93116035b10bd4cf097072afe01726cc96aab25217fe3b25f31a165e108d53d5N.exe
"C:\Users\Admin\AppData\Local\Temp\93116035b10bd4cf097072afe01726cc96aab25217fe3b25f31a165e108d53d5N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1668 -s 596
  2⤵
  PID:2772

memory/1668-0-0x000007FEF5DC3000-0x000007FEF5DC4000-memory.dmp

Filesize
4KB

Download
memory/1668-1-0x000000013F090000-0x000000013F0A8000-memory.dmp

Filesize
96KB

Download
memory/1668-2-0x000007FEF5DC0000-0x000007FEF67AC000-memory.dmp

Filesize
9.9MB

Download
memory/1668-3-0x000007FEF5DC0000-0x000007FEF67AC000-memory.dmp

Filesize
9.9MB

Download