ea380f4397afd9a45aa37e3f6b6c6889f073c30a525937692092cc0c4d859a4e

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
04/11/2023, 21:53

Target

DiscordRAT.exe
Size

26.2MB
MD5

eb4f43afdad8d87c7cbe182bb08b0aa9
SHA1

2e90af56234894333c5338bc2a749cdb2aa8ba93
SHA256

ea380f4397afd9a45aa37e3f6b6c6889f073c30a525937692092cc0c4d859a4e
SHA512

e828c8ab276649e6cc258c319037c160844f9ed45befb5432f3503b3bc2547723d86e738a79ddee07df7bbeb97b422d9d48c56aef1443cb016e2d6c8eb5233fd
SSDEEP

393216:KqsgFQtsPAr7M5liQQETS9vJQnIaw2HOqGW8XPYSDZFu1U0CndOEWdC:KWQtsC7M5lbQEW9hQK2YW8/YSD0DEWE

Score

7^/10

Loads dropped DLL 1 IoCs

pid	Process
1612	DiscordRAT.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 1612	2848	DiscordRAT.exe	28
PID 2848 wrote to memory of 1612	2848	DiscordRAT.exe	28
PID 2848 wrote to memory of 1612	2848	DiscordRAT.exe	28

C:\Users\Admin\AppData\Local\Temp\DiscordRAT.exe
"C:\Users\Admin\AppData\Local\Temp\DiscordRAT.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Users\Admin\AppData\Local\Temp\DiscordRAT.exe
  "C:\Users\Admin\AppData\Local\Temp\DiscordRAT.exe"
  2⤵
  - Loads dropped DLL
  PID:1612

C:\Users\Admin\AppData\Local\Temp\_MEI28482\python311.dll

Filesize
5.5MB

MD5
5a5dd7cad8028097842b0afef45bfbcf

SHA1
e247a2e460687c607253949c52ae2801ff35dc4a

SHA256
a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce

SHA512
e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI28482\python311.dll

Filesize
5.5MB

MD5
5a5dd7cad8028097842b0afef45bfbcf

SHA1
e247a2e460687c607253949c52ae2801ff35dc4a

SHA256
a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce

SHA512
e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858

Download Submit