discordrat | 62241d46e447e877e794a38451c738bff176e7425f6582a3b1714aa0359ccef2

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 07:07

Target

Zenko VIP-v12.exe
Size

78KB
MD5

b88b050994f7c0b3c35ecde9622d554a
SHA1

0b5311ca0657af3d6b4cc10553d275de48bcfbfd
SHA256

62241d46e447e877e794a38451c738bff176e7425f6582a3b1714aa0359ccef2
SHA512

82740e4e3c4e11772950fa7696d1b81fb2d43c67913b87456a5b2742f55f72edc108e11367bc6e09f0c4fa4fc9da3c6213ceea263b8bd292af5efe565defecd4
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+/PIC:5Zv5PDwbjNrmAE+HIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTIwMjA1Mjc1NTgwNDY1MTU0MA.G1PZYx.jgi35ba2DnWeLmysErJxwfGx97NsAhD9z3aqV4
server_id
1202052433518542928

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 3044	2436	Zenko VIP-v12.exe	28
PID 2436 wrote to memory of 3044	2436	Zenko VIP-v12.exe	28
PID 2436 wrote to memory of 3044	2436	Zenko VIP-v12.exe	28

C:\Users\Admin\AppData\Local\Temp\Zenko VIP-v12.exe
"C:\Users\Admin\AppData\Local\Temp\Zenko VIP-v12.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2436 -s 596
  2⤵
  PID:3044

memory/2436-1-0x000000013F3B0000-0x000000013F3C8000-memory.dmp

Filesize
96KB

Download
memory/2436-0-0x000007FEF57D3000-0x000007FEF57D4000-memory.dmp

Filesize
4KB

Download
memory/2436-2-0x000007FEF57D0000-0x000007FEF61BC000-memory.dmp

Filesize
9.9MB

Download
memory/2436-3-0x000007FEF57D3000-0x000007FEF57D4000-memory.dmp

Filesize
4KB

Download
memory/2436-4-0x000007FEF57D0000-0x000007FEF61BC000-memory.dmp

Filesize
9.9MB

Download
memory/2436-5-0x000007FEF57D0000-0x000007FEF61BC000-memory.dmp

Filesize
9.9MB

Download