discordrat | 5f63cca1169589e3fc622bbbef5eb71f0493f42bde55741241a046f06f1b2c79

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
06-01-2025 23:03

Target

5f63cca1169589e3fc622bbbef5eb71f0493f42bde55741241a046f06f1b2c79.exe
Size

78KB
MD5

2cde1e7a18129e8be9c5c1cdafbfe0a4
SHA1

48b4980ef0b11cdcf121a951004e26563298021e
SHA256

5f63cca1169589e3fc622bbbef5eb71f0493f42bde55741241a046f06f1b2c79
SHA512

9f85bda8c63addc98ffc3a08716d4b68787421f52df94e9e72b46fb00aea8f0f842127a295c95a562b8325e7f6948b3e854b9c16bb1b4b3357f8ce76d7e6bea3
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+FPICx:5Zv5PDwbjNrmAE+VICx

Score

10^/10

Family

discordrat

Attributes

discord_token
MTMyMzMzNDQyMjQ2Mzc3ODg3Ng.G9sEop.GWVNDx9fSbbx5x2pRHeE3DO2D7nOrtISmWXhIg
server_id
1323334259145969716

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2324	1904	5f63cca1169589e3fc622bbbef5eb71f0493f42bde55741241a046f06f1b2c79.exe	31
PID 1904 wrote to memory of 2324	1904	5f63cca1169589e3fc622bbbef5eb71f0493f42bde55741241a046f06f1b2c79.exe	31
PID 1904 wrote to memory of 2324	1904	5f63cca1169589e3fc622bbbef5eb71f0493f42bde55741241a046f06f1b2c79.exe	31

C:\Users\Admin\AppData\Local\Temp\5f63cca1169589e3fc622bbbef5eb71f0493f42bde55741241a046f06f1b2c79.exe
"C:\Users\Admin\AppData\Local\Temp\5f63cca1169589e3fc622bbbef5eb71f0493f42bde55741241a046f06f1b2c79.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1904 -s 596
  2⤵
  PID:2324

memory/1904-0-0x000007FEF57F3000-0x000007FEF57F4000-memory.dmp

Filesize
4KB

Download
memory/1904-1-0x000000013F060000-0x000000013F078000-memory.dmp

Filesize
96KB

Download
memory/1904-2-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmp

Filesize
9.9MB

Download
memory/1904-3-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmp

Filesize
9.9MB

Download