discordrat | f5086a9d0e3bdb92e469896feaa431fb9e82c82cf6d031f73b35e5cc8c6331fc

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-02-2025 03:44

Target

f5086a9d0e3bdb92e469896feaa431fb9e82c82cf6d031f73b35e5cc8c6331fc.exe
Size

78KB
MD5

f84e3c47d28a741b08c30c7a04c6ee00
SHA1

b45ae22bd44f7228b9c4a0242e65d2af6d2b7b76
SHA256

f5086a9d0e3bdb92e469896feaa431fb9e82c82cf6d031f73b35e5cc8c6331fc
SHA512

fb62a0d8f8bf29316b0f3490f267df36248f2b8314ca39bab23b33824372a72460f8d62e4c1875388df6f3d5bdbe494f0a95ec90c9255b23f62a2c5f9d978967
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+ZPIC:5Zv5PDwbjNrmAE+pIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTMzODEzMzAzMTI4MTQ5NjA3NQ.G9nEy-.M7VwbXAvMLglPonGh0POraMB1SrrA8Sg01-xIg
server_id
1012892095574454333

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2140	2824	f5086a9d0e3bdb92e469896feaa431fb9e82c82cf6d031f73b35e5cc8c6331fc.exe	30
PID 2824 wrote to memory of 2140	2824	f5086a9d0e3bdb92e469896feaa431fb9e82c82cf6d031f73b35e5cc8c6331fc.exe	30
PID 2824 wrote to memory of 2140	2824	f5086a9d0e3bdb92e469896feaa431fb9e82c82cf6d031f73b35e5cc8c6331fc.exe	30

C:\Users\Admin\AppData\Local\Temp\f5086a9d0e3bdb92e469896feaa431fb9e82c82cf6d031f73b35e5cc8c6331fc.exe
"C:\Users\Admin\AppData\Local\Temp\f5086a9d0e3bdb92e469896feaa431fb9e82c82cf6d031f73b35e5cc8c6331fc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2824 -s 596
  2⤵
  PID:2140

memory/2824-0-0x000007FEF5433000-0x000007FEF5434000-memory.dmp

Filesize
4KB

Download
memory/2824-1-0x000000013F6C0000-0x000000013F6D8000-memory.dmp

Filesize
96KB

Download
memory/2824-2-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

Filesize
9.9MB

Download
memory/2824-3-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

Filesize
9.9MB

Download