discordrat | 1302d9f863c25bae202e553ef078f73d8c0324deff52d8388f7525872519a5bb

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21/03/2024, 00:00

Target

SynapseXCRACKED.exe
Size

78KB
MD5

0ddd31e824f136e691bcfd2a0b9e2670
SHA1

34269cbd62e9badc52af71b2759575593a762fac
SHA256

1302d9f863c25bae202e553ef078f73d8c0324deff52d8388f7525872519a5bb
SHA512

786c994267fbe21e86ee829928b3d24cfa52890214700d5c2bede0232c05f13329ff605e908433c661dd4b7fc24b6a570a79c74f70e0504a43f80ff90d3d1fcb
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+2PIC:5Zv5PDwbjNrmAE+yIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTEyOTI2NjIyNzkxOTk5MDgyNA.GInBmi.k0vV9HhM26FUzP8r3lgj8t304PciR2dvNYNKDQ
server_id
1129494586109206538

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2304	2932	SynapseXCRACKED.exe	28
PID 2932 wrote to memory of 2304	2932	SynapseXCRACKED.exe	28
PID 2932 wrote to memory of 2304	2932	SynapseXCRACKED.exe	28

C:\Users\Admin\AppData\Local\Temp\SynapseXCRACKED.exe
"C:\Users\Admin\AppData\Local\Temp\SynapseXCRACKED.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2932 -s 596
  2⤵
  PID:2304

memory/2932-0-0x000000013F3B0000-0x000000013F3C8000-memory.dmp

Filesize
96KB

Download
memory/2932-1-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp

Filesize
9.9MB

Download
memory/2932-2-0x000000001B9F0000-0x000000001BA70000-memory.dmp

Filesize
512KB

Download
memory/2932-3-0x000007FEF5BD0000-0x000007FEF65BC000-memory.dmp

Filesize
9.9MB

Download
memory/2932-4-0x000000001B9F0000-0x000000001BA70000-memory.dmp

Filesize
512KB

Download