discordrat | 640e8e45aa8817067ce553906216a54b5c2bc398af05d6fd9a015377d4ba2e14

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-06-2024 17:16

Target

SolaraBETA.exe
Size

164KB
MD5

d2030a995a529f7b3e7b13b15d5ed7f4
SHA1

e1901fbf88727d21c8dad1629bfe51e0e89b33cd
SHA256

640e8e45aa8817067ce553906216a54b5c2bc398af05d6fd9a015377d4ba2e14
SHA512

6ad52f7d17da63d5f4359b1b4b7f698ced20cdbdb84a1a8ffbd7e4deef988cf397b9e06a39053c1f7f2944f229b896a40ddf3b0d1c043ca18d4abcc3c069d880
SSDEEP

3072:2Zv5PDwbjNrmAE+gIjLdGgCvZuT75lTT3MJObhH:Wv5PDwbBr0IjLdvm27wJON

Score

10^/10

Family

discordrat

Attributes

discord_token
MTE5NTg0ODc1MjI0NjgyNTA1Mg.Gaa15m.6P5B1ZqVZDkzEJ1KJVCwEZrI2qMc_iYTK6lSK0
server_id
1246418800182824981

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2216	1044	SolaraBETA.exe	28
PID 1044 wrote to memory of 2216	1044	SolaraBETA.exe	28
PID 1044 wrote to memory of 2216	1044	SolaraBETA.exe	28

C:\Users\Admin\AppData\Local\Temp\SolaraBETA.exe
"C:\Users\Admin\AppData\Local\Temp\SolaraBETA.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1044 -s 600
  2⤵
  PID:2216

memory/1044-0-0x000007FEF5B53000-0x000007FEF5B54000-memory.dmp

Filesize
4KB

Download
memory/1044-1-0x000000013FAD0000-0x000000013FAFC000-memory.dmp

Filesize
176KB

Download
memory/1044-2-0x000007FEF5B50000-0x000007FEF653C000-memory.dmp

Filesize
9.9MB

Download
memory/1044-3-0x000007FEF5B53000-0x000007FEF5B54000-memory.dmp

Filesize
4KB

Download
memory/1044-4-0x000007FEF5B50000-0x000007FEF653C000-memory.dmp

Filesize
9.9MB

Download