Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
03-07-2024 19:05
Behavioral task
behavioral1
Sample
veydovokna.exe
Resource
win7-20240419-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
veydovokna.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
veydovokna.exe
-
Size
78KB
-
MD5
7ee32f2553fa474e79b2f1a444172735
-
SHA1
fc17876384c197f73a7471850d13748aa6f659b0
-
SHA256
d99a4d776f04dfd3e8004c466ab81788da8f0ba08b83430df4dd984fa1ef4e39
-
SHA512
2789dc16e615f28c29f5e81ade9e4b03a47d9855cc9092bbcdf90ce7419fe38cabd729a87f038f4aa3d8e2f5317ac69a0637737f468dd8d05532dbd3dda738b9
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+APIC:5Zv5PDwbjNrmAE+kIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI1NjYyNDkzOTk3MzQ4MDYzOA.GmmRJ5.-nbYbt2H8apuatUJNXT2gF-Pq4ZpLJRKwy0hls
-
server_id
1257063713945419826
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
veydovokna.exedescription pid process target process PID 1764 wrote to memory of 1736 1764 veydovokna.exe WerFault.exe PID 1764 wrote to memory of 1736 1764 veydovokna.exe WerFault.exe PID 1764 wrote to memory of 1736 1764 veydovokna.exe WerFault.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1764-0-0x000007FEF5A53000-0x000007FEF5A54000-memory.dmpFilesize
4KB
-
memory/1764-1-0x000000013F760000-0x000000013F778000-memory.dmpFilesize
96KB
-
memory/1764-2-0x000007FEF5A50000-0x000007FEF643C000-memory.dmpFilesize
9.9MB
-
memory/1764-3-0x000007FEF5A53000-0x000007FEF5A54000-memory.dmpFilesize
4KB