discordrat | ce28faa42ddd232b9eaaa74f541973210c43556831a8b6242bba90581db75675

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
22-02-2025 15:37

Target

Client-built.exe
Size

78KB
MD5

b7d931632ff3d8290ea3c8f3b25e5e38
SHA1

b7a0a8c5f44566b5b40715b86fbc96f2ff76cc16
SHA256

ce28faa42ddd232b9eaaa74f541973210c43556831a8b6242bba90581db75675
SHA512

a32e85fff24697c35ed0afd05b47fce0a6bada22fab651e3bfb33087335866815ae26f922bfbfb9e3ef6fb2be6e99d6f7a29de619922334127e703b592110d57
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+wPIC:5Zv5PDwbjNrmAE+0IC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTM0Mjg2NTI4Mjg4NDE3MzkzNQ.GO--qR.B-Xy2KTyXU4BF-yf93wQlD_kexcbEVrhnYBv_o
server_id
1342834826075570286

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 752	2272	Client-built.exe	30
PID 2272 wrote to memory of 752	2272	Client-built.exe	30
PID 2272 wrote to memory of 752	2272	Client-built.exe	30

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2272 -s 600
  2⤵
  PID:752

memory/2272-0-0x000007FEF58E3000-0x000007FEF58E4000-memory.dmp

Filesize
4KB

Download
memory/2272-1-0x000000013F480000-0x000000013F498000-memory.dmp

Filesize
96KB

Download
memory/2272-2-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download
memory/2272-3-0x000007FEF58E3000-0x000007FEF58E4000-memory.dmp

Filesize
4KB

Download
memory/2272-4-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download