File name:

Discordrat.exe

Full analysis: https://app.any.run/tasks/dae44c4f-257b-4311-9234-4b13ba318817
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: April 22, 2026, 18:31:11
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
websocket
discord
discordrat
rat
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows, 2 sections
MD5:

6B58A030B69A9E19760CFC030C3AF25C

SHA1:

3F60B8AE077B4C1FBD721088481CD028EE3EDA78

SHA256:

11F7D56DC27F17AA6CB8951934C6F9BC3B9C8033C3D411995C61E349845E8905

SSDEEP:

1536:jqz9iF806vMqfYppb97777UAhx/+8TUHWMT7RIIR7hZ75f54QQhazQWBBBBBpjbl:jrW06vMqfYppb97777UAhx/+8TUHWMTJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • DISCORDRAT has been detected (YARA)

      • Discordrat.exe (PID: 7368)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Checks supported languages

      • Discordrat.exe (PID: 7368)

    • Disables trace logs

      • Discordrat.exe (PID: 7368)

    • Reads Environment values

      • Discordrat.exe (PID: 7368)

    • Reads the machine GUID from the registry

      • Discordrat.exe (PID: 7368)

    • Reads the computer name

      • Discordrat.exe (PID: 7368)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2050:04:04 10:30:47+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 48
CodeSize: 78848
InitializedDataSize: 1536
UninitializedDataSize: -
EntryPoint: 0x0000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: Discord rat
FileVersion: 1.0.0.0
InternalName: Discord rat.exe
LegalCopyright: Copyright © 2022
LegalTrademarks: -
OriginalFileName: Discord rat.exe
ProductName: Discord rat
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
135
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #DISCORDRAT discordrat.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
4624C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7368"C:\Users\admin\Desktop\Discordrat.exe" C:\Users\admin\Desktop\Discordrat.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Discord rat
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\discordrat.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
7 236
Read events
7 221
Write events
15
Delete events
0

Modification events

(PID) Process:(7368) Discordrat.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Discordrat_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7368) Discordrat.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Discordrat_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7368) Discordrat.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Discordrat_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(7368) Discordrat.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Discordrat_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(7368) Discordrat.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Discordrat_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(7368) Discordrat.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Discordrat_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(7368) Discordrat.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Discordrat_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(7368) Discordrat.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Discordrat_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7368) Discordrat.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Discordrat_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7368) Discordrat.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Discordrat_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
46
TCP/UDP connections
35
DNS requests
17
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5276
MoUsoCoreWorker.exe
GET
304
51.104.136.2:443
https://settings-win.data.microsoft.com/settings/v3.0/wsd/muse?ProcessorClockSpeed=3094&FlightIds=&UpdateOfferedDays=4294967295&BranchReadinessLevel=CB&OEMManufacturerName=DELL&IsCloudDomainJoined=0&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&sku=48&ActivationChannel=Retail&AttrDataVer=186&IsMDMEnrolled=0&ProcessorCores=6&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&TotalPhysicalRAM=6144&PrimaryDiskType=4294967295&FlightingBranchName=&ChassisTypeId=1&OEMModelNumber=DELL&SystemVolumeTotalCapacity=260281&sampleId=95271487&deviceClass=Windows.Desktop&App=muse&DisableDualScan=0&AppVer=10.0&OEMSubModel=J5CR&locale=en-US&IsAlwaysOnAlwaysConnectedCapable=0&ms=0&DefaultUserRegion=244&UpdateServiceUrl=http%3A%2F%2Fneverupdatewindows10.com&osVer=10.0.19045.4046.amd64fre.vb_release.191206-1406&os=windows&deviceId=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&DeferQualityUpdatePeriodInDays=0&ring=Retail&DeferFeatureUpdatePeriodInDays=30
US
—
—
whitelisted
7368
Discordrat.exe
GET
101
162.159.133.234:443
https://gateway.discord.gg/?v=9&encording=json
US
—
—
unknown
6844
SIHClient.exe
GET
304
74.179.77.204:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
6844
SIHClient.exe
GET
200
20.165.94.54:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
US
—
—
whitelisted
6844
SIHClient.exe
GET
200
74.179.77.204:443
https://slscr.update.microsoft.com/sls/ping
US
—
—
whitelisted
7368
Discordrat.exe
GET
101
162.159.133.234:443
https://gateway.discord.gg/?v=9&encording=json
unknown
—
—
—
6844
SIHClient.exe
GET
304
74.179.77.204:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
5708
svchost.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
5708
svchost.exe
GET
200
23.52.181.212:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
5276
MoUsoCoreWorker.exe
GET
200
23.52.181.212:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5276
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
8028
slui.exe
48.192.1.65:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5708
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
5708
svchost.exe
2.16.164.120:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
7368
Discordrat.exe
162.159.133.234:443
gateway.discord.gg
CLOUDFLARENET
US
whitelisted
5708
svchost.exe
23.52.181.212:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
5276
MoUsoCoreWorker.exe
23.52.181.212:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
5208
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
activation-v2.sls.microsoft.com
  • 48.192.1.65
whitelisted
google.com
  • 142.251.110.113
  • 142.251.110.139
  • 142.251.110.138
  • 142.251.110.100
  • 142.251.110.102
  • 142.251.110.101
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.49
whitelisted
gateway.discord.gg
  • 162.159.133.234
  • 162.159.135.234
  • 162.159.136.234
  • 162.159.130.234
  • 162.159.134.234
whitelisted
www.microsoft.com
  • 23.52.181.212
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
slscr.update.microsoft.com
  • 74.179.77.204
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.165.94.54
whitelisted
self.events.data.microsoft.com
  • 20.42.73.27
whitelisted

Threats

PID
Process
Class
Message
2232
svchost.exe
Misc activity
ET INFO Discord Chat Service Domain in DNS Lookup (gateway .discord .gg)
7368
Discordrat.exe
Misc activity
ET INFO Observed Discord Service Domain (gateway .discord .gg) in TLS SNI
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Websocket Upgrade Request
7368
Discordrat.exe
Not Suspicious Traffic
INFO [ANY.RUN] Websocket Upgrade Request
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Discordrat.exe