discordrat | d005912875fed025544a38fd356ae7472df10979f023d82814db8bb667ea8bbe

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-01-2025 16:06

Target

d005912875fed025544a38fd356ae7472df10979f023d82814db8bb667ea8bbeN.exe
Size

78KB
MD5

4d7aca5d5b871edfb68464834bfd0a30
SHA1

3760f55447efb2cb2bfb250ac5c639b1684c7238
SHA256

d005912875fed025544a38fd356ae7472df10979f023d82814db8bb667ea8bbe
SHA512

08484c8395775eee9f59624ce25837959e6c2e933c425e3a82446e661c765417235fcf24e288b53a33c413fe127917dfa0e0ad305b5b2c7807814fc81afda88e
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+gPIC:5Zv5PDwbjNrmAE+EIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTMyNTAxMTIyOTk2NTY4MDcxMg.GVbtJu.NiHaLGAe8ngV52ERblctO7HS_Ax5yYvARm0euQ
server_id
1324735552167346220

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2792	3060	d005912875fed025544a38fd356ae7472df10979f023d82814db8bb667ea8bbeN.exe	30
PID 3060 wrote to memory of 2792	3060	d005912875fed025544a38fd356ae7472df10979f023d82814db8bb667ea8bbeN.exe	30
PID 3060 wrote to memory of 2792	3060	d005912875fed025544a38fd356ae7472df10979f023d82814db8bb667ea8bbeN.exe	30

C:\Users\Admin\AppData\Local\Temp\d005912875fed025544a38fd356ae7472df10979f023d82814db8bb667ea8bbeN.exe
"C:\Users\Admin\AppData\Local\Temp\d005912875fed025544a38fd356ae7472df10979f023d82814db8bb667ea8bbeN.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3060 -s 596
  2⤵
  PID:2792

memory/3060-0-0x000007FEF5753000-0x000007FEF5754000-memory.dmp

Filesize
4KB

Download
memory/3060-1-0x000000013F660000-0x000000013F678000-memory.dmp

Filesize
96KB

Download
memory/3060-2-0x000007FEF5750000-0x000007FEF613C000-memory.dmp

Filesize
9.9MB

Download
memory/3060-3-0x000007FEF5750000-0x000007FEF613C000-memory.dmp

Filesize
9.9MB

Download