discordrat | ff48d5fb5dc36db21d99a9780b59c2bc23c3215e41217b3aa6a4121edf886327

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 14:38

Target

ghostcs.exe
Size

78KB
MD5

55091df917246bce3e12c087eb8ad1a0
SHA1

1a39684fce67917e130df8865cfafea490a43a53
SHA256

ff48d5fb5dc36db21d99a9780b59c2bc23c3215e41217b3aa6a4121edf886327
SHA512

4581547526caababaf227ff52e2f45440285631890723d42b61fbd77570168db94da9e62bc9e548031716b5fc02a8aa688f9b4e12238c41a4e0daaad2fd07990
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+JPIC:5Zv5PDwbjNrmAE+5IC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTIxNDYyODY1ODY2MTE2MzE1MA.Gx3-BL.-7p60GLcs3FsrG0WbxHs4adsATCT14DDI_pqtk
server_id
1214626289537908827

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 1212	2248	ghostcs.exe	28
PID 2248 wrote to memory of 1212	2248	ghostcs.exe	28
PID 2248 wrote to memory of 1212	2248	ghostcs.exe	28

C:\Users\Admin\AppData\Local\Temp\ghostcs.exe
"C:\Users\Admin\AppData\Local\Temp\ghostcs.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2248 -s 596
  2⤵
  PID:1212

memory/2248-0-0x000000013FFE0000-0x000000013FFF8000-memory.dmp

Filesize
96KB

Download
memory/2248-1-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

Filesize
9.9MB

Download
memory/2248-2-0x0000000002380000-0x0000000002400000-memory.dmp

Filesize
512KB

Download
memory/2248-3-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

Filesize
9.9MB

Download
memory/2248-4-0x0000000002380000-0x0000000002400000-memory.dmp

Filesize
512KB

Download