discordrat | ede3f079fb9f121432930517b86136403abb237792009b3ae4be81d75bf90256

Analysis

max time kernel
30s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-01-2025 12:07

Target

ede3f079fb9f121432930517b86136403abb237792009b3ae4be81d75bf90256N.exe
Size

78KB
MD5

8e8666dc4f856c891addd0bf8b94bb50
SHA1

b276f6605be8bdbbde153c90531b9206121d1314
SHA256

ede3f079fb9f121432930517b86136403abb237792009b3ae4be81d75bf90256
SHA512

d595d79eb907ed246ab2ba0f786a3d98f8f57b7dc01304874db71809b1188217adc041daacfb2d186e1985ce21a2c79c417cd9f61f32e32eb30aa437944a23b9
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+FPIC:5Zv5PDwbjNrmAE+VIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTMyMzMzNDQyMjQ2Mzc3ODg3Ng.G9sEop.GWVNDx9fSbbx5x2pRHeE3DO2D7nOrtISmWXhIg
server_id
1323334259145969716

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2740	2392	ede3f079fb9f121432930517b86136403abb237792009b3ae4be81d75bf90256N.exe	30
PID 2392 wrote to memory of 2740	2392	ede3f079fb9f121432930517b86136403abb237792009b3ae4be81d75bf90256N.exe	30
PID 2392 wrote to memory of 2740	2392	ede3f079fb9f121432930517b86136403abb237792009b3ae4be81d75bf90256N.exe	30

C:\Users\Admin\AppData\Local\Temp\ede3f079fb9f121432930517b86136403abb237792009b3ae4be81d75bf90256N.exe
"C:\Users\Admin\AppData\Local\Temp\ede3f079fb9f121432930517b86136403abb237792009b3ae4be81d75bf90256N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2392 -s 600
  2⤵
  PID:2740

memory/2392-0-0x000007FEF55D3000-0x000007FEF55D4000-memory.dmp

Filesize
4KB

Download
memory/2392-1-0x000000013FA30000-0x000000013FA48000-memory.dmp

Filesize
96KB

Download
memory/2392-2-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp

Filesize
9.9MB

Download
memory/2392-3-0x000007FEF55D0000-0x000007FEF5FBC000-memory.dmp

Filesize
9.9MB

Download