discordrat | 20a651cfc2657727ef9e2eef975dfb59694d8dae632c7c946f14a68a755d3b02

Analysis

max time kernel
15s
max time network
17s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
31-12-2024 14:24

Target

20a651cfc2657727ef9e2eef975dfb59694d8dae632c7c946f14a68a755d3b02.exe
Size

78KB
MD5

23f56c06370699c488af7eb38720e09d
SHA1

43a3913c7cffb616e242e04053ca61a6f414b3a3
SHA256

20a651cfc2657727ef9e2eef975dfb59694d8dae632c7c946f14a68a755d3b02
SHA512

8314be2dacb68d580bbde736b9dfd9346cdcb2724bb2c9253207517a4906a4c8d22c6e65e447574022f6170fea0857562d05bf771e84ab6f916abc5673e8f064
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+CPICr:5Zv5PDwbjNrmAE+uICr

Score

10^/10

Family

discordrat

Attributes

discord_token
MTMyMTAyNDgwMDY1MDU2MzU5NA.G1Lkaa.Rjv16HjyLqgc3OurSWxyZU3Hp-XIFxeGWV8AsI
server_id
1321017162042966038

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 1892	2312	20a651cfc2657727ef9e2eef975dfb59694d8dae632c7c946f14a68a755d3b02.exe	30
PID 2312 wrote to memory of 1892	2312	20a651cfc2657727ef9e2eef975dfb59694d8dae632c7c946f14a68a755d3b02.exe	30
PID 2312 wrote to memory of 1892	2312	20a651cfc2657727ef9e2eef975dfb59694d8dae632c7c946f14a68a755d3b02.exe	30

C:\Users\Admin\AppData\Local\Temp\20a651cfc2657727ef9e2eef975dfb59694d8dae632c7c946f14a68a755d3b02.exe
"C:\Users\Admin\AppData\Local\Temp\20a651cfc2657727ef9e2eef975dfb59694d8dae632c7c946f14a68a755d3b02.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2312 -s 596
  2⤵
  PID:1892

memory/2312-0-0x000007FEF5C53000-0x000007FEF5C54000-memory.dmp

Filesize
4KB

Download
memory/2312-1-0x000000013F920000-0x000000013F938000-memory.dmp

Filesize
96KB

Download
memory/2312-2-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download
memory/2312-3-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

Filesize
9.9MB

Download