fe5babb459b6efece0241e14768c284fe3f0d99fe05261ab9a55c9446b348eed

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-06-2024 18:08

Target

Discord-RAT-2.0-2.0/Discord rat/Resources/unrootkit.exe
Size

3.3MB
MD5

56561903fd1e9dedfe029dd8c9172e7c
SHA1

ca2fbcd301d4e1ddb3e7fd2b53099e12c06e48c6
SHA256

4350a69f2630214a7b079e41e3ac2d7c5759a622a0cd1227ba12eee06d758d9a
SHA512

e16345c92a1639b4ff712591c5f736618ca6b0f83399e5f2265c747fe6829065dfcf9a27486e562ea0766b61c6362611e726e8bf7e943aab4e738bade1d8590d
SSDEEP

49152:x8ImhHy69ztxaY5lyni2DBZKe8taaY5lSni2DBZWL:OZdyeJH6

Score

10^/10

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

unrootkit.exe

description pid process target process

PID 2904 created 432 2904 unrootkit.exe winlogon.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

unrootkit.exe

description pid process target process

PID 2904 set thread context of 2700 2904 unrootkit.exe dllhost.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

unrootkit.exedllhost.exe

pid process

2904 unrootkit.exe
2700 dllhost.exe
2700 dllhost.exe
2700 dllhost.exe
2700 dllhost.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

unrootkit.exedllhost.exe

description pid process

Token: SeDebugPrivilege 2904 unrootkit.exe
Token: SeDebugPrivilege 2700 dllhost.exe

description	pid	process	target process
PID 2904 created 432	2904	unrootkit.exe	winlogon.exe

description	pid	process	target process
PID 2904 set thread context of 2700	2904	unrootkit.exe	dllhost.exe

description	pid	process
Token: SeDebugPrivilege	2904	unrootkit.exe
Token: SeDebugPrivilege	2700	dllhost.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

unrootkit.exe

description	pid	process	target process
PID 2904 wrote to memory of 2700	2904	unrootkit.exe	dllhost.exe
PID 2904 wrote to memory of 2700	2904	unrootkit.exe	dllhost.exe
PID 2904 wrote to memory of 2700	2904	unrootkit.exe	dllhost.exe
PID 2904 wrote to memory of 2700	2904	unrootkit.exe	dllhost.exe
PID 2904 wrote to memory of 2700	2904	unrootkit.exe	dllhost.exe
PID 2904 wrote to memory of 2700	2904	unrootkit.exe	dllhost.exe
PID 2904 wrote to memory of 2700	2904	unrootkit.exe	dllhost.exe
PID 2904 wrote to memory of 2700	2904	unrootkit.exe	dllhost.exe
PID 2904 wrote to memory of 2700	2904	unrootkit.exe	dllhost.exe
PID 2904 wrote to memory of 2700	2904	unrootkit.exe	dllhost.exe
PID 2904 wrote to memory of 2700	2904	unrootkit.exe	dllhost.exe
PID 2904 wrote to memory of 2700	2904	unrootkit.exe	dllhost.exe
PID 2904 wrote to memory of 2700	2904	unrootkit.exe	dllhost.exe
PID 2904 wrote to memory of 2700	2904	unrootkit.exe	dllhost.exe
PID 2904 wrote to memory of 2700	2904	unrootkit.exe	dllhost.exe
PID 2904 wrote to memory of 2700	2904	unrootkit.exe	dllhost.exe

memory/2700-7-0x0000000140000000-0x000000014018A000-memory.dmp

Filesize
1.5MB

Download
memory/2700-3-0x0000000140000000-0x000000014018A000-memory.dmp

Filesize
1.5MB

Download
memory/2700-8-0x0000000140000000-0x000000014018A000-memory.dmp

Filesize
1.5MB

Download
memory/2904-0-0x000007FEF55DE000-0x000007FEF55DF000-memory.dmp

Filesize
4KB

Download
memory/2904-1-0x0000000076F20000-0x00000000770C9000-memory.dmp

Filesize
1.7MB

Download
memory/2904-2-0x0000000076D00000-0x0000000076E1F000-memory.dmp

Filesize
1.1MB

Download
memory/2904-5-0x0000000076D01000-0x0000000076D9C000-memory.dmp

Filesize
620KB

Download
memory/2904-4-0x0000000076F21000-0x0000000077022000-memory.dmp

Filesize
1.0MB

Download
memory/2904-9-0x000007FEF5320000-0x000007FEF5CBD000-memory.dmp

Filesize
9.6MB

Download
memory/2904-10-0x000007FEF5320000-0x000007FEF5CBD000-memory.dmp

Filesize
9.6MB

Download