discordrat | 9e37c85517f2475ecb79759df8a479ac1ca0c1dc788bd961e55001adf3ee4004

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01-05-2024 11:13

Target

Celery Bootstrapper.exe
Size

204KB
MD5

02b71a38b3d55018b7f5c316543d5a8f
SHA1

c214652b538e94b19204e83e54483d911921d72a
SHA256

9e37c85517f2475ecb79759df8a479ac1ca0c1dc788bd961e55001adf3ee4004
SHA512

489de9c196ddd4cc92b3e3d9d20945c74cf3d0839940d0a2db88ab32bddf55e822c53f2c98034698eff72a28cc0da8b35527a8e5f9c3995109f68f0e323473fd
SSDEEP

1536:f2WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+/PId+ovpfCfRRuaLgv+y1C3qzkn1:fZv5PDwbjNrmAE+HIMu2RuJGxB4RM

Score

10^/10

Family

discordrat

Attributes

discord_token
MTE1NzU5MjUzOTQyODMwNzA2NA.Gco7Ft.BhtXaKRPsK-ZaaFbpomOTsGS41VToi1-dZqMqM
server_id
1165103369547939933

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2196	2648	Celery Bootstrapper.exe	28
PID 2648 wrote to memory of 2196	2648	Celery Bootstrapper.exe	28
PID 2648 wrote to memory of 2196	2648	Celery Bootstrapper.exe	28

C:\Users\Admin\AppData\Local\Temp\Celery Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Celery Bootstrapper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2648 -s 600
  2⤵
  PID:2196

memory/2648-0-0x000000013F4F0000-0x000000013F526000-memory.dmp

Filesize
216KB

Download
memory/2648-1-0x000007FEF5B50000-0x000007FEF653C000-memory.dmp

Filesize
9.9MB

Download
memory/2648-2-0x00000000025B0000-0x0000000002630000-memory.dmp

Filesize
512KB

Download
memory/2648-3-0x000007FEF5B50000-0x000007FEF653C000-memory.dmp

Filesize
9.9MB

Download
memory/2648-4-0x00000000025B0000-0x0000000002630000-memory.dmp

Filesize
512KB

Download