c8de0e92e603214114f8800dd99ecf8cb69ac85caf8010a99ba3f66afe70fcbf

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 03:39

Target

Discord-RAT-2.0-master/Discord rat/Resources/unrootkit.exe
Size

3.3MB
MD5

56561903fd1e9dedfe029dd8c9172e7c
SHA1

ca2fbcd301d4e1ddb3e7fd2b53099e12c06e48c6
SHA256

4350a69f2630214a7b079e41e3ac2d7c5759a622a0cd1227ba12eee06d758d9a
SHA512

e16345c92a1639b4ff712591c5f736618ca6b0f83399e5f2265c747fe6829065dfcf9a27486e562ea0766b61c6362611e726e8bf7e943aab4e738bade1d8590d
SSDEEP

49152:x8ImhHy69ztxaY5lyni2DBZKe8taaY5lSni2DBZWL:OZdyeJH6

Score

10^/10

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1932 created 436	1932	unrootkit.exe	5

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1932 set thread context of 2500	1932	unrootkit.exe	29

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1932	unrootkit.exe
Token: SeDebugPrivilege	2500	dllhost.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2500	1932	unrootkit.exe	29
PID 1932 wrote to memory of 2500	1932	unrootkit.exe	29
PID 1932 wrote to memory of 2500	1932	unrootkit.exe	29
PID 1932 wrote to memory of 2500	1932	unrootkit.exe	29
PID 1932 wrote to memory of 2500	1932	unrootkit.exe	29
PID 1932 wrote to memory of 2500	1932	unrootkit.exe	29
PID 1932 wrote to memory of 2500	1932	unrootkit.exe	29
PID 1932 wrote to memory of 2500	1932	unrootkit.exe	29
PID 1932 wrote to memory of 2500	1932	unrootkit.exe	29
PID 1932 wrote to memory of 2500	1932	unrootkit.exe	29
PID 1932 wrote to memory of 2500	1932	unrootkit.exe	29
PID 1932 wrote to memory of 2500	1932	unrootkit.exe	29
PID 1932 wrote to memory of 2500	1932	unrootkit.exe	29
PID 1932 wrote to memory of 2500	1932	unrootkit.exe	29
PID 1932 wrote to memory of 2500	1932	unrootkit.exe	29
PID 1932 wrote to memory of 2500	1932	unrootkit.exe	29

memory/1932-0-0x000007FEF566E000-0x000007FEF566F000-memory.dmp

Filesize
4KB

Download
memory/1932-2-0x0000000076D40000-0x0000000076E5F000-memory.dmp

Filesize
1.1MB

Download
memory/1932-1-0x0000000076E60000-0x0000000077009000-memory.dmp

Filesize
1.7MB

Download
memory/1932-8-0x000007FEF53B0000-0x000007FEF5D4D000-memory.dmp

Filesize
9.6MB

Download
memory/1932-5-0x0000000076D41000-0x0000000076DDC000-memory.dmp

Filesize
620KB

Download
memory/1932-4-0x0000000076E61000-0x0000000076F62000-memory.dmp

Filesize
1.0MB

Download
memory/2500-3-0x0000000140000000-0x000000014018A000-memory.dmp

Filesize
1.5MB

Download
memory/2500-7-0x0000000140000000-0x000000014018A000-memory.dmp

Filesize
1.5MB

Download
memory/2500-9-0x0000000140000000-0x000000014018A000-memory.dmp

Filesize
1.5MB

Download
memory/2500-10-0x0000000140000000-0x000000014018A000-memory.dmp

Filesize
1.5MB

Download