discordrat | 628d9e3a5515899777f9b2ef321673cadf93734a035adf1ffedd94cce3c3a499

Analysis

max time kernel
24s
max time network
17s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 20:14

Target

CatWare-Nuker.exe
Size

290KB
MD5

47685feb5e2eeacc958c1efd25633b1a
SHA1

261cafb2622320dc14dcfefc31481628582518c9
SHA256

628d9e3a5515899777f9b2ef321673cadf93734a035adf1ffedd94cce3c3a499
SHA512

887f83ad6444a0b4d6600c27f7db9f4fa60b97362b7ab66ac62e60256b6af2111a67a74e2bf8f638dbd3295b2c18a429e147a4a344a7a7552a6156707ffad9be
SSDEEP

6144:wv5PDwbBrBIYFOb9cYYXNHqicllitUczh6B9R2d9VxYEls1FjJxqa:wv5b8eCrdVc3iT6o9w

Score

10^/10

Family

discordrat

Attributes

discord_token
MTIxMTA5OTM2NzcyMTc5NTYzNA.G70pQ3.qyY48cmh2SJtYIOWlG3foa8Y6OUXwjioSm1FOU
server_id
1211092147235987486

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2728	2076	CatWare-Nuker.exe	28
PID 2076 wrote to memory of 2728	2076	CatWare-Nuker.exe	28
PID 2076 wrote to memory of 2728	2076	CatWare-Nuker.exe	28

C:\Users\Admin\AppData\Local\Temp\CatWare-Nuker.exe
"C:\Users\Admin\AppData\Local\Temp\CatWare-Nuker.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2076 -s 600
  2⤵
  PID:2728

memory/2076-0-0x000000013FF80000-0x000000013FFCC000-memory.dmp

Filesize
304KB

Download
memory/2076-1-0x000007FEF51A0000-0x000007FEF5B8C000-memory.dmp

Filesize
9.9MB

Download
memory/2076-2-0x000000001BA60000-0x000000001BAE0000-memory.dmp

Filesize
512KB

Download
memory/2076-3-0x000007FEF51A0000-0x000007FEF5B8C000-memory.dmp

Filesize
9.9MB

Download
memory/2076-4-0x000000001BA60000-0x000000001BAE0000-memory.dmp

Filesize
512KB

Download