discordrat | d8c89492ce546f9f8c93f32d8f588f24430ed1474cf94c829a357d6831134941

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
21-02-2025 07:22

Target

d8c89492ce546f9f8c93f32d8f588f24430ed1474cf94c829a357d6831134941.exe
Size

78KB
MD5

11fc8fd9abe3d177bf97cc3021c9c70f
SHA1

126706c0ef6087941fa3f6060d9a9ac87ff3a69e
SHA256

d8c89492ce546f9f8c93f32d8f588f24430ed1474cf94c829a357d6831134941
SHA512

56f0126608630f3bcf8ef3693d6caa41fb85b71fe7be0ba23fd8e88839b253d1cf5ffb699bc1e7b6987fa9d126f96e8034109558a1e466913abc0f054c5422ce
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+kPIC:5Zv5PDwbjNrmAE+4IC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTM0MTUxOTI2Mzg4NTgyNDA3Mw.GIMjzQ.3ahVrwPiBDUOavG7cggk_eoN4_TXLFf-saRC04
server_id
1341518669251088486

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 308 wrote to memory of 2508	308	d8c89492ce546f9f8c93f32d8f588f24430ed1474cf94c829a357d6831134941.exe	30
PID 308 wrote to memory of 2508	308	d8c89492ce546f9f8c93f32d8f588f24430ed1474cf94c829a357d6831134941.exe	30
PID 308 wrote to memory of 2508	308	d8c89492ce546f9f8c93f32d8f588f24430ed1474cf94c829a357d6831134941.exe	30

C:\Users\Admin\AppData\Local\Temp\d8c89492ce546f9f8c93f32d8f588f24430ed1474cf94c829a357d6831134941.exe
"C:\Users\Admin\AppData\Local\Temp\d8c89492ce546f9f8c93f32d8f588f24430ed1474cf94c829a357d6831134941.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:308
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 308 -s 596
  2⤵
  PID:2508

memory/308-0-0x000007FEF5E63000-0x000007FEF5E64000-memory.dmp

Filesize
4KB

Download
memory/308-1-0x000000013FB70000-0x000000013FB88000-memory.dmp

Filesize
96KB

Download
memory/308-2-0x000007FEF5E60000-0x000007FEF684C000-memory.dmp

Filesize
9.9MB

Download
memory/308-3-0x000007FEF5E60000-0x000007FEF684C000-memory.dmp

Filesize
9.9MB

Download