discordrat | a4c32a18c068a82aa1c31ae329da38ee37ee45d2ca3ac2b6352e0fc67f92810c

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 01:25

Target

Damirus_Logger.exe
Size

78KB
MD5

3fbba0d0ddf0b27cb2870848ed425a92
SHA1

6a0624f77d832b5c18449468ec77ddc68621d221
SHA256

a4c32a18c068a82aa1c31ae329da38ee37ee45d2ca3ac2b6352e0fc67f92810c
SHA512

5c49cefae53b08883a047e08f3aced0903a88ef5b107eeef1749f1e6b749b7753433168c3ba3a9d3d9e8c1aae0f8d01387b78f2e57b0981892e81738a9b16c46
SSDEEP

1536:P2WjO8XeEXFV5P7v88wbjNrfxCXhRoKV6+V+NuPIC:PZ75PDwbjNrmAE+UIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTE3MDg0MjIwNDYzMDE2MzUxOA.GcCpTt.1E-_WBCJhe489svO-s1oVX1xYz1u4kg4ZAv1Qc
server_id
1168354244890480820

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2412	2932	Damirus_Logger.exe	28
PID 2932 wrote to memory of 2412	2932	Damirus_Logger.exe	28
PID 2932 wrote to memory of 2412	2932	Damirus_Logger.exe	28

C:\Users\Admin\AppData\Local\Temp\Damirus_Logger.exe
"C:\Users\Admin\AppData\Local\Temp\Damirus_Logger.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2932 -s 596
  2⤵
  PID:2412

memory/2932-0-0x000000013F070000-0x000000013F088000-memory.dmp

Filesize
96KB

Download
memory/2932-1-0x000007FEF5720000-0x000007FEF610C000-memory.dmp

Filesize
9.9MB

Download
memory/2932-2-0x000000001B4B0000-0x000000001B530000-memory.dmp

Filesize
512KB

Download
memory/2932-3-0x000007FEF5720000-0x000007FEF610C000-memory.dmp

Filesize
9.9MB

Download
memory/2932-4-0x000000001B4B0000-0x000000001B530000-memory.dmp

Filesize
512KB

Download
memory/2932-5-0x000007FEF5720000-0x000007FEF610C000-memory.dmp

Filesize
9.9MB

Download