discordrat | 28f9130367f3f962a2456d46c81c4c69b9d8f9da612eb6151a5cc0326255d0e0

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
26-01-2025 17:20

Target

16e0775352021a90c3dec5a4d75d5db0b444ed8cae060fccdb86fde2080bdc82.exe
Size

78KB
MD5

e3347a9a35a3397e489ae738b27f7cc7
SHA1

e72a6f4f1fed3513aeef20986cb362e5d2fdfebe
SHA256

16e0775352021a90c3dec5a4d75d5db0b444ed8cae060fccdb86fde2080bdc82
SHA512

a75da2b099bef712bcf87c02aa23e84d5d90f5b0a9e5bb0a27b437ddd6ad777768a1273052e72a720e141db61c4f0ebbe50316df069253afc675a7e46bbb3151
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+5PIC:5Zv5PDwbjNrmAE+JIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTMzMDYxOTg4NTMzMTQxNTEyMA.GvolIj.JCM-OtlpaFBedk3GoFB_aY1Hi31oF4XpkLv81A
server_id
1330576263034699828

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2332	2100	16e0775352021a90c3dec5a4d75d5db0b444ed8cae060fccdb86fde2080bdc82.exe	30
PID 2100 wrote to memory of 2332	2100	16e0775352021a90c3dec5a4d75d5db0b444ed8cae060fccdb86fde2080bdc82.exe	30
PID 2100 wrote to memory of 2332	2100	16e0775352021a90c3dec5a4d75d5db0b444ed8cae060fccdb86fde2080bdc82.exe	30

C:\Users\Admin\AppData\Local\Temp\16e0775352021a90c3dec5a4d75d5db0b444ed8cae060fccdb86fde2080bdc82.exe
"C:\Users\Admin\AppData\Local\Temp\16e0775352021a90c3dec5a4d75d5db0b444ed8cae060fccdb86fde2080bdc82.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2100 -s 596
  2⤵
  PID:2332

memory/2100-0-0x000007FEF6173000-0x000007FEF6174000-memory.dmp

Filesize
4KB

Download
memory/2100-1-0x000000013F3C0000-0x000000013F3D8000-memory.dmp

Filesize
96KB

Download
memory/2100-2-0x000007FEF6170000-0x000007FEF6B5C000-memory.dmp

Filesize
9.9MB

Download
memory/2100-3-0x000007FEF6170000-0x000007FEF6B5C000-memory.dmp

Filesize
9.9MB

Download