discordrat | ba01d643332652be36e704f127ef68488849e784b8df4226f9a30d3f27bddead

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 11:46

Target

Kipasguys April upd.exe
Size

100KB
MD5

6541c6a5be34631c7f25f82058e05cf3
SHA1

1ceba49ddbf055ca835d69d83840509193f9940d
SHA256

ba01d643332652be36e704f127ef68488849e784b8df4226f9a30d3f27bddead
SHA512

71fb77c3789836cd9592a432fcd5fb63cc731cdcf3ab19522def227dbfd9ee421ce8950de0e5042d2cad56af8b2c816f24079015491fd54e7c2521f5f179114e
SSDEEP

1536:V2WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+bPIUr1k5eNqX78HgWwF:VZv5PDwbjNrmAE+TI/5R4E

Score

10^/10

Family

discordrat

Attributes

discord_token
MTE0Mjk0NTIyOTE1NTA4NjM4Ng.GNC5nh.GedwJI0vdVK867mzXHvlAYPudHoYL8kC77kzM0
server_id
1229075705594122292

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2072	2876	Kipasguys April upd.exe	28
PID 2876 wrote to memory of 2072	2876	Kipasguys April upd.exe	28
PID 2876 wrote to memory of 2072	2876	Kipasguys April upd.exe	28

C:\Users\Admin\AppData\Local\Temp\Kipasguys April upd.exe
"C:\Users\Admin\AppData\Local\Temp\Kipasguys April upd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2876 -s 596
  2⤵
  PID:2072

memory/2876-0-0x000000013F880000-0x000000013F89C000-memory.dmp

Filesize
112KB

Download
memory/2876-1-0x000007FEF5DD0000-0x000007FEF67BC000-memory.dmp

Filesize
9.9MB

Download
memory/2876-2-0x000000001BBE0000-0x000000001BC60000-memory.dmp

Filesize
512KB

Download
memory/2876-3-0x000007FEF5DD0000-0x000007FEF67BC000-memory.dmp

Filesize
9.9MB

Download
memory/2876-4-0x000000001BBE0000-0x000000001BC60000-memory.dmp

Filesize
512KB

Download