discordrat | 3166ca8bc5b981c157a6793150b4e99de9f5741dd6e14af9b1fcfa8c052f7ce7

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
19-06-2024 05:50

Target

9424d6ca1fc2ce929e79b5a8d8d3c650_NeikiAnalytics.exe
Size

78KB
MD5

9424d6ca1fc2ce929e79b5a8d8d3c650
SHA1

9a2c006699b50d5c9e4f7b73fa64f99f7622224e
SHA256

3166ca8bc5b981c157a6793150b4e99de9f5741dd6e14af9b1fcfa8c052f7ce7
SHA512

68dbab8c15f8944e8bccb6fb942f176134654a3cd644e8957b723d65197381a9ff97ef0f9e24d57008f5b14b39270cd9c7fa78674605c9f5d6e236fd7eee2487
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+nJPIC:5Zv5PDwbjNrmAE+n5IC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI1MTE1NTAyMTY5MzcxNDQ5NA.GgQ1ag.AF8zd5W06EJvUkTZSulHyzFeNNpxflm0gfgJBs
server_id
1251156859554103347

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 956	1916	9424d6ca1fc2ce929e79b5a8d8d3c650_NeikiAnalytics.exe	28
PID 1916 wrote to memory of 956	1916	9424d6ca1fc2ce929e79b5a8d8d3c650_NeikiAnalytics.exe	28
PID 1916 wrote to memory of 956	1916	9424d6ca1fc2ce929e79b5a8d8d3c650_NeikiAnalytics.exe	28

C:\Users\Admin\AppData\Local\Temp\9424d6ca1fc2ce929e79b5a8d8d3c650_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\9424d6ca1fc2ce929e79b5a8d8d3c650_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1916 -s 596
  2⤵
  PID:956

memory/1916-0-0x000007FEF5CE3000-0x000007FEF5CE4000-memory.dmp

Filesize
4KB

Download
memory/1916-1-0x000000013F500000-0x000000013F518000-memory.dmp

Filesize
96KB

Download
memory/1916-2-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmp

Filesize
9.9MB

Download
memory/1916-3-0x000007FEF5CE3000-0x000007FEF5CE4000-memory.dmp

Filesize
4KB

Download
memory/1916-4-0x000007FEF5CE0000-0x000007FEF66CC000-memory.dmp

Filesize
9.9MB

Download