discordrat | 453e0d2ee1b5a35add511145b4f4ef6b7dbe8eae6e93652ad0a19b61af294000

Analysis

max time kernel
92s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-02-2025 02:27

Target

453e0d2ee1b5a35add511145b4f4ef6b7dbe8eae6e93652ad0a19b61af294000N.exe
Size

78KB
MD5

f390812797af393df9ed2a01e670ed70
SHA1

5d042a218bd03ce4f53e3c413bd483fd4c04ee7d
SHA256

453e0d2ee1b5a35add511145b4f4ef6b7dbe8eae6e93652ad0a19b61af294000
SHA512

02f8ef0d32a413be2ad96330e341edab481cc65dde1f324d137a90a1176e3eb40d1cec6e9e8e7bf1098fb4fa332ccb90c6abdbd684164cfb76c5aceb254aa123
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+dPIC:5Zv5PDwbjNrmAE+NIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTMzNDg2ODQ0OTQ4MjI0ODI1NA.Gfn3Zp.JLsMt1DJyl2BRKGnfJyJCStA144I28izJVPav8
server_id
1335159502953254943

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1532	1996	453e0d2ee1b5a35add511145b4f4ef6b7dbe8eae6e93652ad0a19b61af294000N.exe	31
PID 1996 wrote to memory of 1532	1996	453e0d2ee1b5a35add511145b4f4ef6b7dbe8eae6e93652ad0a19b61af294000N.exe	31
PID 1996 wrote to memory of 1532	1996	453e0d2ee1b5a35add511145b4f4ef6b7dbe8eae6e93652ad0a19b61af294000N.exe	31

C:\Users\Admin\AppData\Local\Temp\453e0d2ee1b5a35add511145b4f4ef6b7dbe8eae6e93652ad0a19b61af294000N.exe
"C:\Users\Admin\AppData\Local\Temp\453e0d2ee1b5a35add511145b4f4ef6b7dbe8eae6e93652ad0a19b61af294000N.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1996 -s 596
  2⤵
  PID:1532

memory/1996-0-0x000007FEF5813000-0x000007FEF5814000-memory.dmp

Filesize
4KB

Download
memory/1996-1-0x000000013F830000-0x000000013F848000-memory.dmp

Filesize
96KB

Download
memory/1996-2-0x000007FEF5810000-0x000007FEF61FC000-memory.dmp

Filesize
9.9MB

Download
memory/1996-3-0x000007FEF5810000-0x000007FEF61FC000-memory.dmp

Filesize
9.9MB

Download