discordrat | 830ea2fb5b31f1579ad9d59940c0a9895fc6c8ceec5c45c5f2604f7e4a5227ad

Analysis

max time kernel
118s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-03-2024 15:00

Target

MoMowA.exe
Size

78KB
MD5

2134f0cbed3a8398034cb78610a0ffe4
SHA1

966b3cb2ec2d3494f7aaffca9bad5559c6d4c320
SHA256

9e0574b31c5dc6356e84796082be6f7ff319bc43c57b24657d1e6930c863018a
SHA512

936d2282287b2ca788c82a6afbbe8d6733375c52ad70cff55e2798463e41706cf36de6bc71c74e8aca7f487f96b4ea918c3469500cc03f2fd446bea6cc85e346
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+RPIC:5Zv5PDwbjNrmAE+BIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTIxMzg1OTc0OTA5OTk5NTE1Ng.GrWby9.mJ91kTjDMlDqeg1nwJTmQUCJaPjtYk5eenqOnU
server_id
1213859181925240924

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 2456	1504	MoMowA.exe	28
PID 1504 wrote to memory of 2456	1504	MoMowA.exe	28
PID 1504 wrote to memory of 2456	1504	MoMowA.exe	28

C:\Users\Admin\AppData\Local\Temp\MoMowA.exe
"C:\Users\Admin\AppData\Local\Temp\MoMowA.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1504 -s 596
  2⤵
  PID:2456

memory/1504-0-0x000000013FD30000-0x000000013FD48000-memory.dmp

Filesize
96KB

Download
memory/1504-1-0x000007FEF5DF0000-0x000007FEF67DC000-memory.dmp

Filesize
9.9MB

Download
memory/1504-2-0x000000001BB80000-0x000000001BC00000-memory.dmp

Filesize
512KB

Download
memory/1504-3-0x000007FEF5DF0000-0x000007FEF67DC000-memory.dmp

Filesize
9.9MB

Download
memory/1504-4-0x000000001BB80000-0x000000001BC00000-memory.dmp

Filesize
512KB

Download