Analysis Overview
SHA256
74b6089379acff9803a37c3b5e8bc86c5877a319c4ced5a714ff9c9c63905188
Threat Level: Known bad
The file zip.zip was found to be: Known bad.
Malicious Activity Summary
Discord RAT
Discordrat family
Unsigned PE
Suspicious use of WriteProcessMemory
MITRE ATT&CK Matrix
Analysis: static1
Detonation Overview
Reported
2024-06-25 14:36
Signatures
Discordrat family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-25 14:36
Reported
2024-06-25 14:39
Platform
win7-20240611-en
Max time kernel
119s
Max time network
123s
Command Line
Signatures
Discord RAT
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3040 wrote to memory of 3004 | N/A | C:\Users\Admin\AppData\Local\Temp\cdumper\compiler.exe | C:\Windows\system32\WerFault.exe |
| PID 3040 wrote to memory of 3004 | N/A | C:\Users\Admin\AppData\Local\Temp\cdumper\compiler.exe | C:\Windows\system32\WerFault.exe |
| PID 3040 wrote to memory of 3004 | N/A | C:\Users\Admin\AppData\Local\Temp\cdumper\compiler.exe | C:\Windows\system32\WerFault.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\cdumper\compiler.exe
"C:\Users\Admin\AppData\Local\Temp\cdumper\compiler.exe"
C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3040 -s 596
Network
Files
memory/3040-0-0x000007FEF58E3000-0x000007FEF58E4000-memory.dmp
memory/3040-1-0x000000013F950000-0x000000013F968000-memory.dmp
memory/3040-2-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp
memory/3040-3-0x000007FEF58E0000-0x000007FEF62CC000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-25 14:36
Reported
2024-06-25 14:39
Platform
win7-20240611-en
Max time kernel
118s
Max time network
119s
Command Line
Signatures
Processes
C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\cdumper\setup.bat"