fe5babb459b6efece0241e14768c284fe3f0d99fe05261ab9a55c9446b348eed

Analysis

max time kernel
93s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-06-2024 18:08

Target

Discord-RAT-2.0-2.0/Discord rat/Resources/unrootkit.exe
Size

3.3MB
MD5

56561903fd1e9dedfe029dd8c9172e7c
SHA1

ca2fbcd301d4e1ddb3e7fd2b53099e12c06e48c6
SHA256

4350a69f2630214a7b079e41e3ac2d7c5759a622a0cd1227ba12eee06d758d9a
SHA512

e16345c92a1639b4ff712591c5f736618ca6b0f83399e5f2265c747fe6829065dfcf9a27486e562ea0766b61c6362611e726e8bf7e943aab4e738bade1d8590d
SSDEEP

49152:x8ImhHy69ztxaY5lyni2DBZKe8taaY5lSni2DBZWL:OZdyeJH6

Score

10^/10

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

unrootkit.exe

description pid process target process

PID 2452 created 636 2452 unrootkit.exe winlogon.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

unrootkit.exe

description pid process target process

PID 2452 set thread context of 332 2452 unrootkit.exe dllhost.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

unrootkit.exedllhost.exe

pid process

2452 unrootkit.exe
332 dllhost.exe
332 dllhost.exe
332 dllhost.exe
332 dllhost.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

unrootkit.exedllhost.exe

description pid process

Token: SeDebugPrivilege 2452 unrootkit.exe
Token: SeDebugPrivilege 332 dllhost.exe

description	pid	process	target process
PID 2452 created 636	2452	unrootkit.exe	winlogon.exe

description	pid	process	target process
PID 2452 set thread context of 332	2452	unrootkit.exe	dllhost.exe

description	pid	process
Token: SeDebugPrivilege	2452	unrootkit.exe
Token: SeDebugPrivilege	332	dllhost.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

unrootkit.exe

description	pid	process	target process
PID 2452 wrote to memory of 332	2452	unrootkit.exe	dllhost.exe
PID 2452 wrote to memory of 332	2452	unrootkit.exe	dllhost.exe
PID 2452 wrote to memory of 332	2452	unrootkit.exe	dllhost.exe
PID 2452 wrote to memory of 332	2452	unrootkit.exe	dllhost.exe
PID 2452 wrote to memory of 332	2452	unrootkit.exe	dllhost.exe
PID 2452 wrote to memory of 332	2452	unrootkit.exe	dllhost.exe
PID 2452 wrote to memory of 332	2452	unrootkit.exe	dllhost.exe
PID 2452 wrote to memory of 332	2452	unrootkit.exe	dllhost.exe
PID 2452 wrote to memory of 332	2452	unrootkit.exe	dllhost.exe
PID 2452 wrote to memory of 332	2452	unrootkit.exe	dllhost.exe
PID 2452 wrote to memory of 332	2452	unrootkit.exe	dllhost.exe
PID 2452 wrote to memory of 332	2452	unrootkit.exe	dllhost.exe
PID 2452 wrote to memory of 332	2452	unrootkit.exe	dllhost.exe
PID 2452 wrote to memory of 332	2452	unrootkit.exe	dllhost.exe
PID 2452 wrote to memory of 332	2452	unrootkit.exe	dllhost.exe

memory/332-5-0x0000000140000000-0x000000014018A000-memory.dmp

Filesize
1.5MB

Download
memory/332-6-0x0000000140000000-0x000000014018A000-memory.dmp

Filesize
1.5MB

Download
memory/332-4-0x0000000140000000-0x000000014018A000-memory.dmp

Filesize
1.5MB

Download
memory/332-9-0x0000000140000000-0x000000014018A000-memory.dmp

Filesize
1.5MB

Download
memory/332-11-0x0000000140000000-0x000000014018A000-memory.dmp

Filesize
1.5MB

Download
memory/2452-0-0x00007FF974495000-0x00007FF974496000-memory.dmp

Filesize
4KB

Download
memory/2452-1-0x00007FF9741E0000-0x00007FF974B81000-memory.dmp

Filesize
9.6MB

Download
memory/2452-3-0x00007FF9915B0000-0x00007FF99166E000-memory.dmp

Filesize
760KB

Download
memory/2452-2-0x00007FF992C70000-0x00007FF992E65000-memory.dmp

Filesize
2.0MB

Download
memory/2452-8-0x00007FF9741E0000-0x00007FF974B81000-memory.dmp

Filesize
9.6MB

Download
memory/2452-10-0x00007FF9741E0000-0x00007FF974B81000-memory.dmp

Filesize
9.6MB

Download