discordrat | d36d6acbf03b8b696fcd584dc29481758ee861a54019a18ea3c0b8c5a553fcbb

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-01-2025 04:53

Target

d36d6acbf03b8b696fcd584dc29481758ee861a54019a18ea3c0b8c5a553fcbb.exe
Size

78KB
MD5

661b51bef9a0c186f90de8e9878e8fb5
SHA1

18ada100e2e64d1cec0d4023ace25a6df1936a52
SHA256

d36d6acbf03b8b696fcd584dc29481758ee861a54019a18ea3c0b8c5a553fcbb
SHA512

55b3ed6fd50910c289b890734cc87f600bbf6eb3033caac34ac32b945b34a13560b2e9a914b253409a5159bf29eddabafffed8f143a8c3e5a9de6d786f257fb6
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+jPICJ:5Zv5PDwbjNrmAE+7ICJ

Score

10^/10

Family

discordrat

Attributes

discord_token
MTMyNDA4OTE0OTM2MzMyNjk3Nw.GC8frp.HLqqcaLZBagbe-6YPLoLZO2HuHlqK4JaSVgeLw
server_id
1324089576436011021

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 1976	1980	d36d6acbf03b8b696fcd584dc29481758ee861a54019a18ea3c0b8c5a553fcbb.exe	31
PID 1980 wrote to memory of 1976	1980	d36d6acbf03b8b696fcd584dc29481758ee861a54019a18ea3c0b8c5a553fcbb.exe	31
PID 1980 wrote to memory of 1976	1980	d36d6acbf03b8b696fcd584dc29481758ee861a54019a18ea3c0b8c5a553fcbb.exe	31

C:\Users\Admin\AppData\Local\Temp\d36d6acbf03b8b696fcd584dc29481758ee861a54019a18ea3c0b8c5a553fcbb.exe
"C:\Users\Admin\AppData\Local\Temp\d36d6acbf03b8b696fcd584dc29481758ee861a54019a18ea3c0b8c5a553fcbb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1980 -s 596
  2⤵
  PID:1976

memory/1980-0-0x000007FEF57D3000-0x000007FEF57D4000-memory.dmp

Filesize
4KB

Download
memory/1980-1-0x000000013F5A0000-0x000000013F5B8000-memory.dmp

Filesize
96KB

Download
memory/1980-2-0x000007FEF57D0000-0x000007FEF61BC000-memory.dmp

Filesize
9.9MB

Download
memory/1980-3-0x000007FEF57D0000-0x000007FEF61BC000-memory.dmp

Filesize
9.9MB

Download