Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
26-07-2024 19:02
Behavioral task
behavioral1
Sample
sigma.exe
Resource
win7-20240704-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
sigma.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
sigma.exe
-
Size
78KB
-
MD5
1b29c01dc26295000d69aa5237e9ea95
-
SHA1
34d81d53e28031c4d5f0a5d1e1d85390fc6b339e
-
SHA256
126d3abd2382378833b22df594d176fbf08223e9dc3679364bc46ac835296323
-
SHA512
273013ff15cab03072afb33946688785f28d261e19ce5fde890035e0b8900e53b9642d7fe2cf9c3799dbfb73ac1d4a3508c5b3f8752a5bc877212ad181254fad
-
SSDEEP
1536:/2WjO8XeEXFi5P7v88wbjNrfxCXhRoKV6+V+NPIC:/Zs5PDwbjNrmAE+dIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
1168063029754216448
-
server_id
1168062993934852176
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1656 wrote to memory of 2236 1656 sigma.exe 31 PID 1656 wrote to memory of 2236 1656 sigma.exe 31 PID 1656 wrote to memory of 2236 1656 sigma.exe 31