discordrat | b59b4ff95f3a48024c6926d893c9ff83f0cc5a3cb09e65d4dc1e66ed198fb1ca

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-01-2025 02:10

Target

b59b4ff95f3a48024c6926d893c9ff83f0cc5a3cb09e65d4dc1e66ed198fb1ca.exe
Size

78KB
MD5

752a8a79fc7bd174f7cd40ef34add0bb
SHA1

cfc8bd68bf9aedd75d78a22ac500e0282ce1836f
SHA256

b59b4ff95f3a48024c6926d893c9ff83f0cc5a3cb09e65d4dc1e66ed198fb1ca
SHA512

edf4acdb289b21290959e8bddd0dbdcd59d73b5b18bffef2a124e4951e790473b5dc94a0db658d6f21646796ff7dcb863b662a20a6be36dd07ad889e117cc317
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+IPICR:5Zv5PDwbjNrmAE+MICR

Score

10^/10

Family

discordrat

Attributes

discord_token
MTMyNDM1NTExMTc0ODc2Nzc4NA.G2CKF3.y_8019btFtzzpOR0WXT_5nKv34bTD7w3OFJDgE
server_id
1324357325623918592

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2548	2092	b59b4ff95f3a48024c6926d893c9ff83f0cc5a3cb09e65d4dc1e66ed198fb1ca.exe	30
PID 2092 wrote to memory of 2548	2092	b59b4ff95f3a48024c6926d893c9ff83f0cc5a3cb09e65d4dc1e66ed198fb1ca.exe	30
PID 2092 wrote to memory of 2548	2092	b59b4ff95f3a48024c6926d893c9ff83f0cc5a3cb09e65d4dc1e66ed198fb1ca.exe	30

C:\Users\Admin\AppData\Local\Temp\b59b4ff95f3a48024c6926d893c9ff83f0cc5a3cb09e65d4dc1e66ed198fb1ca.exe
"C:\Users\Admin\AppData\Local\Temp\b59b4ff95f3a48024c6926d893c9ff83f0cc5a3cb09e65d4dc1e66ed198fb1ca.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2092 -s 596
  2⤵
  PID:2548

memory/2092-0-0x000007FEF5903000-0x000007FEF5904000-memory.dmp

Filesize
4KB

Download
memory/2092-1-0x000000013FFE0000-0x000000013FFF8000-memory.dmp

Filesize
96KB

Download
memory/2092-2-0x000007FEF5900000-0x000007FEF62EC000-memory.dmp

Filesize
9.9MB

Download
memory/2092-3-0x000007FEF5900000-0x000007FEF62EC000-memory.dmp

Filesize
9.9MB

Download