discordrat | 45e83d1277abd0a69f5a33f0cc20c51f804bbd26e9a0686117247ad4f27ed81a | Triage

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10/01/2025, 18:00

Sharing

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

4a3ad9a17023d32b70d14c88747b0302
SHA1

a24fdb9e259d5db66a00aa392aea4b146a697787
SHA256

45e83d1277abd0a69f5a33f0cc20c51f804bbd26e9a0686117247ad4f27ed81a
SHA512

ee86349f849c0edf7a1c1080f71e12e8c659c6cffec168a3e6da5eaf52f9ecac69d0b2b7c01d69e282d6f44ad890cf60f080fd11b425fb93a74e0b7218d6070b
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+iPIC:5Zv5PDwbjNrmAE+OIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMyNzMxODAyNTIyMDkxNTIyMA.Gbhmly.2VnF8G_nnJt-kiY3NLK0toQR92qky0l7vAaT4Y
server_id
1327319098295582744

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2436	1992	Client-built.exe	30
PID 1992 wrote to memory of 2436	1992	Client-built.exe	30
PID 1992 wrote to memory of 2436	1992	Client-built.exe	30

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1992 -s 596
  2⤵
  PID:2436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1992-0-0x000007FEF55B3000-0x000007FEF55B4000-memory.dmp

Filesize
4KB

Download
memory/1992-1-0x000000013F090000-0x000000013F0A8000-memory.dmp

Filesize
96KB

Download
memory/1992-2-0x000007FEF55B0000-0x000007FEF5F9C000-memory.dmp

Filesize
9.9MB

Download
memory/1992-3-0x000007FEF55B0000-0x000007FEF5F9C000-memory.dmp

Filesize
9.9MB

Download