discordrat | c1cdd25217e0107de1fc8c291e2331dbe21509273917969263e3f2d6317251bb

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
04-01-2025 10:59

Target

Swift/Bootstrap/Swift Executor/SWIFT/Swift Executor/Swift Bootstrapper.exe
Size

78KB
MD5

4d7aca5d5b871edfb68464834bfd0a30
SHA1

3760f55447efb2cb2bfb250ac5c639b1684c7238
SHA256

d005912875fed025544a38fd356ae7472df10979f023d82814db8bb667ea8bbe
SHA512

08484c8395775eee9f59624ce25837959e6c2e933c425e3a82446e661c765417235fcf24e288b53a33c413fe127917dfa0e0ad305b5b2c7807814fc81afda88e
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+gPIC:5Zv5PDwbjNrmAE+EIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTMyNTAxMTIyOTk2NTY4MDcxMg.GVbtJu.NiHaLGAe8ngV52ERblctO7HS_Ax5yYvARm0euQ
server_id
1324735552167346220

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 2432	1272	Swift Bootstrapper.exe	30
PID 1272 wrote to memory of 2432	1272	Swift Bootstrapper.exe	30
PID 1272 wrote to memory of 2432	1272	Swift Bootstrapper.exe	30

C:\Users\Admin\AppData\Local\Temp\Swift\Bootstrap\Swift Executor\SWIFT\Swift Executor\Swift Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Swift\Bootstrap\Swift Executor\SWIFT\Swift Executor\Swift Bootstrapper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1272 -s 596
  2⤵
  PID:2432

memory/1272-0-0x000007FEF5D03000-0x000007FEF5D04000-memory.dmp

Filesize
4KB

Download
memory/1272-1-0x000000013F5D0000-0x000000013F5E8000-memory.dmp

Filesize
96KB

Download
memory/1272-2-0x000007FEF5D00000-0x000007FEF66EC000-memory.dmp

Filesize
9.9MB

Download
memory/1272-3-0x000007FEF5D00000-0x000007FEF66EC000-memory.dmp

Filesize
9.9MB

Download