Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23-06-2024 23:29
Behavioral task
behavioral1
Sample
66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
Resource
win10v2004-20240508-en
General
-
Target
66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe
-
Size
78KB
-
MD5
01ada4c5d09fec1f9fbe503e1236253c
-
SHA1
b55d8fc3ba0efa1b2cfdf39103031bc7476b208d
-
SHA256
66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce
-
SHA512
aec7493bb9efa11e6e65708eb7be37329bdfc93bc119410f8ecdfa6de9e1e9db9c250eea6617852c3e1ef0f23977cd53978187e498c6a446e0f39176590cf88c
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+UPIC:5Zv5PDwbjNrmAE+IIC
Malware Config
Extracted
discordrat
-
discord_token
MTI1MzY2NzkzMTcwMzc0MjQ3NA.GAS6tu.j9MK0FmUah1Hrzwqu4CSCBB7ZoOlp1sSBJGGw0
-
server_id
1250682422434074634
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exedescription pid process target process PID 2228 wrote to memory of 2396 2228 66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe WerFault.exe PID 2228 wrote to memory of 2396 2228 66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe WerFault.exe PID 2228 wrote to memory of 2396 2228 66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"C:\Users\Admin\AppData\Local\Temp\66cbb4776eeb80d91450a41ee674dac90350a0cd138fbc10a4b1e3ce5d8bd2ce.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2228 -s 6002⤵PID:2396
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2228-0-0x000007FEF5DC3000-0x000007FEF5DC4000-memory.dmpFilesize
4KB
-
memory/2228-1-0x000000013F930000-0x000000013F948000-memory.dmpFilesize
96KB
-
memory/2228-2-0x000007FEF5DC0000-0x000007FEF67AC000-memory.dmpFilesize
9.9MB
-
memory/2228-3-0x000007FEF5DC0000-0x000007FEF67AC000-memory.dmpFilesize
9.9MB