discordrat | 379449b8c2d0053cea2aa786cf2ad6e3cd61e67793ac5b68be77358360b0ce42

Resubmissions

25-06-2024 22:00

max time kernel
149s
max time network
124s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25-06-2024 22:00

Target

Medusa.exe
Size

78KB
MD5

5b4483e4d0d5d3c245509d44f6ede105
SHA1

7f55b3ff41fa5a810e44d74b79f5bf3953882707
SHA256

379449b8c2d0053cea2aa786cf2ad6e3cd61e67793ac5b68be77358360b0ce42
SHA512

14066a18f5439efc767cecd347b658679ba39fc7135bcbe6f3c731ceb38ce614788015391df1ed2fcdda9233d2a655156126d298e94d7479ccfb99028fb2012a
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+vPIC:5Zv5PDwbjNrmAE+XIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTIwNDEwODc0MjM5Njg3MDczNw.Gw9Kyr.z1zBnV1wCUwvnB-hn8vkxiW22uEX8O5oY4F9Qk
server_id
1204106853043273729

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Medusa.exe

description	pid	process	target process
PID 2360 wrote to memory of 2936	2360	Medusa.exe	WerFault.exe
PID 2360 wrote to memory of 2936	2360	Medusa.exe	WerFault.exe
PID 2360 wrote to memory of 2936	2360	Medusa.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Medusa.exe
"C:\Users\Admin\AppData\Local\Temp\Medusa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2360

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2360 -s 600
2⤵
PID:2936

memory/2360-0-0x000007FEF5C93000-0x000007FEF5C94000-memory.dmp

Filesize
4KB

Download
memory/2360-1-0x000000013F0E0000-0x000000013F0F8000-memory.dmp

Filesize
96KB

Download
memory/2360-2-0x000007FEF5C90000-0x000007FEF667C000-memory.dmp

Filesize
9.9MB

Download
memory/2360-3-0x000007FEF5C93000-0x000007FEF5C94000-memory.dmp

Filesize
4KB

Download
memory/2360-4-0x000007FEF5C90000-0x000007FEF667C000-memory.dmp

Filesize
9.9MB

Download
memory/2360-5-0x000007FEF5C90000-0x000007FEF667C000-memory.dmp

Filesize
9.9MB

Download