c8de0e92e603214114f8800dd99ecf8cb69ac85caf8010a99ba3f66afe70fcbf

Analysis

max time kernel
91s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 03:39

Target

Discord-RAT-2.0-master/Discord rat/Resources/unrootkit.exe
Size

3.3MB
MD5

56561903fd1e9dedfe029dd8c9172e7c
SHA1

ca2fbcd301d4e1ddb3e7fd2b53099e12c06e48c6
SHA256

4350a69f2630214a7b079e41e3ac2d7c5759a622a0cd1227ba12eee06d758d9a
SHA512

e16345c92a1639b4ff712591c5f736618ca6b0f83399e5f2265c747fe6829065dfcf9a27486e562ea0766b61c6362611e726e8bf7e943aab4e738bade1d8590d
SSDEEP

49152:x8ImhHy69ztxaY5lyni2DBZKe8taaY5lSni2DBZWL:OZdyeJH6

Score

10^/10

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

unrootkit.exe

description pid process target process

PID 1356 created 616 1356 unrootkit.exe winlogon.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

unrootkit.exe

description pid process target process

PID 1356 set thread context of 3100 1356 unrootkit.exe dllhost.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

unrootkit.exedllhost.exe

pid process

1356 unrootkit.exe
3100 dllhost.exe
3100 dllhost.exe
3100 dllhost.exe
3100 dllhost.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

unrootkit.exedllhost.exe

description pid process

Token: SeDebugPrivilege 1356 unrootkit.exe
Token: SeDebugPrivilege 3100 dllhost.exe

description	pid	process	target process
PID 1356 created 616	1356	unrootkit.exe	winlogon.exe

description	pid	process	target process
PID 1356 set thread context of 3100	1356	unrootkit.exe	dllhost.exe

description	pid	process
Token: SeDebugPrivilege	1356	unrootkit.exe
Token: SeDebugPrivilege	3100	dllhost.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

unrootkit.exe

description	pid	process	target process
PID 1356 wrote to memory of 3100	1356	unrootkit.exe	dllhost.exe
PID 1356 wrote to memory of 3100	1356	unrootkit.exe	dllhost.exe
PID 1356 wrote to memory of 3100	1356	unrootkit.exe	dllhost.exe
PID 1356 wrote to memory of 3100	1356	unrootkit.exe	dllhost.exe
PID 1356 wrote to memory of 3100	1356	unrootkit.exe	dllhost.exe
PID 1356 wrote to memory of 3100	1356	unrootkit.exe	dllhost.exe
PID 1356 wrote to memory of 3100	1356	unrootkit.exe	dllhost.exe
PID 1356 wrote to memory of 3100	1356	unrootkit.exe	dllhost.exe
PID 1356 wrote to memory of 3100	1356	unrootkit.exe	dllhost.exe
PID 1356 wrote to memory of 3100	1356	unrootkit.exe	dllhost.exe
PID 1356 wrote to memory of 3100	1356	unrootkit.exe	dllhost.exe
PID 1356 wrote to memory of 3100	1356	unrootkit.exe	dllhost.exe
PID 1356 wrote to memory of 3100	1356	unrootkit.exe	dllhost.exe
PID 1356 wrote to memory of 3100	1356	unrootkit.exe	dllhost.exe
PID 1356 wrote to memory of 3100	1356	unrootkit.exe	dllhost.exe

memory/1356-0-0x00007FFBF0C65000-0x00007FFBF0C66000-memory.dmp

Filesize
4KB

Download
memory/1356-1-0x00007FFC0ED90000-0x00007FFC0EF85000-memory.dmp

Filesize
2.0MB

Download
memory/1356-3-0x00007FFBF09B0000-0x00007FFBF1351000-memory.dmp

Filesize
9.6MB

Download
memory/1356-2-0x00007FFC0CEF0000-0x00007FFC0CFAE000-memory.dmp

Filesize
760KB

Download
memory/1356-10-0x00007FFBF09B0000-0x00007FFBF1351000-memory.dmp

Filesize
9.6MB

Download
memory/1356-8-0x00007FFBF09B0000-0x00007FFBF1351000-memory.dmp

Filesize
9.6MB

Download
memory/3100-4-0x0000000140000000-0x000000014018A000-memory.dmp

Filesize
1.5MB

Download
memory/3100-7-0x0000000140000000-0x000000014018A000-memory.dmp

Filesize
1.5MB

Download
memory/3100-9-0x0000000140000000-0x000000014018A000-memory.dmp

Filesize
1.5MB

Download
memory/3100-5-0x0000000140000000-0x000000014018A000-memory.dmp

Filesize
1.5MB

Download
memory/3100-11-0x0000000140000000-0x000000014018A000-memory.dmp

Filesize
1.5MB

Download