discordrat | 3ce93b5813e1b8534a70b227f7e8503e10c3480607032c9744354faa2ac4a070

Analysis

max time kernel
1559s
max time network
1560s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-03-2024 02:36

Target

Nova Patcher V2.exe
Size

78KB
MD5

ef61bc4d93013d6072d6b6b4b2231f58
SHA1

a604af75290366150af26cb64bd9bedc01ab7b78
SHA256

3ce93b5813e1b8534a70b227f7e8503e10c3480607032c9744354faa2ac4a070
SHA512

4cb794bac0eba98e54affbb7c1620113409b3065c515e7565e31848ad2a446010f7216459e7f0f101013e46847a309f56967866ba7b20a85650e51572c3ebc6a
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+kPIC:5Zv5PDwbjNrmAE+4IC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTE5MzM5NjMyNzQzNDk0NDUzMg.GQtyFE.630ymbBowAmccfehQ9LqT14nEeJOjZV4R1iwvU
server_id
1193395247854653511

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2192	2112	Nova Patcher V2.exe	28
PID 2112 wrote to memory of 2192	2112	Nova Patcher V2.exe	28
PID 2112 wrote to memory of 2192	2112	Nova Patcher V2.exe	28

C:\Users\Admin\AppData\Local\Temp\Nova Patcher V2.exe
"C:\Users\Admin\AppData\Local\Temp\Nova Patcher V2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2112 -s 600
  2⤵
  PID:2192

memory/2112-0-0x000000013FD70000-0x000000013FD88000-memory.dmp

Filesize
96KB

Download
memory/2112-1-0x000007FEF59E0000-0x000007FEF63CC000-memory.dmp

Filesize
9.9MB

Download
memory/2112-2-0x000000001BB90000-0x000000001BC10000-memory.dmp

Filesize
512KB

Download
memory/2112-3-0x000007FEF59E0000-0x000007FEF63CC000-memory.dmp

Filesize
9.9MB

Download
memory/2112-4-0x000000001BB90000-0x000000001BC10000-memory.dmp

Filesize
512KB

Download