discordrat | d624951bfc5e38a018beb94c1c8acb97a6becca52e6d069b156b5e55608f857a

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 12:39

Target
Onnx File Installer.exe
Size 78KB
Sample240602-pvywpsde46
SHA256 2a470ef5fe5f825bf643a3d1fa819659857513a2c81cdc9a0305235617dc1b04
MD5 e35f5c4a4d3763f1c9ea5ae6001c6ae4
SHA1 32869af3cae52873656cfc64f4c169151c2bdd7d
SHA512 8d3045ce0304c45a3be7a046940c6453c08386d5697e721161ac9f6cc5dfc68deecdbc5de94045153963e0810c486d9ceaa9e3229c60b7121cc85be57700645e
SSDEEP 1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+5PIC:5Zv5PDwbjNrmAE+JIC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Attributes

discord_token
MTI0MzM1NDI0NDI1NDI3MzYzNw.GUkt7C.Pcja3LSm_8Cp1CqJOlASW0-GzRtoJOOBBsmJcg
server_id
1232533200622845975

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 3044	1932	Onnx File Installer.exe	28
PID 1932 wrote to memory of 3044	1932	Onnx File Installer.exe	28
PID 1932 wrote to memory of 3044	1932	Onnx File Installer.exe	28

C:\Users\Admin\AppData\Local\Temp\Onnx File Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Onnx File Installer.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1932 -s 600
  2⤵
  PID:3044

memory/1932-0-0x000007FEF52E3000-0x000007FEF52E4000-memory.dmp

Download

memory/1932-1-0x000000013F560000-0x000000013F578000-memory.dmp

Download

memory/1932-2-0x000007FEF52E0000-0x000007FEF5CCC000-memory.dmp

Download

memory/1932-3-0x000007FEF52E0000-0x000007FEF5CCC000-memory.dmp

Download