discordrat | aed0081d6aa8fa3b29d155c6bb45e9278b4562102f8d4497a51db56871a74134

Resubmissions

31-05-2024 20:14

31-05-2024 20:12

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31-05-2024 20:14

Target

monoware.exe
Size

78KB
MD5

8da8b05938831e8e547b60526236ece7
SHA1

c27806eed416f8676548d89aa0207d028f800234
SHA256

aed0081d6aa8fa3b29d155c6bb45e9278b4562102f8d4497a51db56871a74134
SHA512

552e09c36ec48d3117209546e70b1322b929d3f5c59f49af4e66f51c5123230bec766a7315de022027afc0d41920fa7f86f42d82e4f000ac73bab08136221ec6
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+MPIC:5Zv5PDwbjNrmAE+gIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI0NjE3NzQ1MDg3OTA5MDY5OA.GQYQs_.CWWy01exlwJSA5-Ryb8HsR5UWeE5uOF58bPcZs
server_id
1243377281129254984

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2756	2292	monoware.exe	28
PID 2292 wrote to memory of 2756	2292	monoware.exe	28
PID 2292 wrote to memory of 2756	2292	monoware.exe	28

C:\Users\Admin\AppData\Local\Temp\monoware.exe
"C:\Users\Admin\AppData\Local\Temp\monoware.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2292 -s 604
  2⤵
  PID:2756

memory/2292-0-0x000007FEF58E3000-0x000007FEF58E4000-memory.dmp

Filesize
4KB

Download
memory/2292-1-0x000000013FE00000-0x000000013FE18000-memory.dmp

Filesize
96KB

Download
memory/2292-2-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download
memory/2292-3-0x000007FEF58E3000-0x000007FEF58E4000-memory.dmp

Filesize
4KB

Download
memory/2292-4-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp

Filesize
9.9MB

Download