discordrat | 73228bd4affdbcc9c2a44d4c0f2578475a83f4ab521f916abf433e6e5480ec1d

Analysis

max time kernel
15s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/02/2025, 07:00

Target

73228bd4affdbcc9c2a44d4c0f2578475a83f4ab521f916abf433e6e5480ec1dN.exe
Size

78KB
MD5

015b8190fd40f34487c0686a9188c0a0
SHA1

fc661ba310a917a0ab8bbd0fa8dcd0f5175f8868
SHA256

73228bd4affdbcc9c2a44d4c0f2578475a83f4ab521f916abf433e6e5480ec1d
SHA512

036a6968116f9b7babc18788e171c8da88740b9dd46f2fdde76e8ca18d9a979cc7e963faa83bb0654e629f1273bd0530617ad968ad5afc8304ceccbcbfd2ea4e
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+rPIC:5Zv5PDwbjNrmAE+DIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTM0MDE4ODUyODQ2MTc0NjIzOA.GAfEAv.M3O9-86qg8MsXSV6k_h3y0TN00HU1kNY4orBd4
server_id
1340189193472835645

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 3044	2912	73228bd4affdbcc9c2a44d4c0f2578475a83f4ab521f916abf433e6e5480ec1dN.exe	30
PID 2912 wrote to memory of 3044	2912	73228bd4affdbcc9c2a44d4c0f2578475a83f4ab521f916abf433e6e5480ec1dN.exe	30
PID 2912 wrote to memory of 3044	2912	73228bd4affdbcc9c2a44d4c0f2578475a83f4ab521f916abf433e6e5480ec1dN.exe	30

C:\Users\Admin\AppData\Local\Temp\73228bd4affdbcc9c2a44d4c0f2578475a83f4ab521f916abf433e6e5480ec1dN.exe
"C:\Users\Admin\AppData\Local\Temp\73228bd4affdbcc9c2a44d4c0f2578475a83f4ab521f916abf433e6e5480ec1dN.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2912 -s 596
  2⤵
  PID:3044

memory/2912-0-0x000007FEF5F13000-0x000007FEF5F14000-memory.dmp

Filesize
4KB

Download
memory/2912-1-0x000000013F220000-0x000000013F238000-memory.dmp

Filesize
96KB

Download
memory/2912-2-0x000007FEF5F10000-0x000007FEF68FC000-memory.dmp

Filesize
9.9MB

Download
memory/2912-3-0x000007FEF5F10000-0x000007FEF68FC000-memory.dmp

Filesize
9.9MB

Download