discordrat | b9351151cb27d1032feae32c5750e65b8e4a47ea67ed86e15d2bc7bd42fd1a64

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23-08-2024 09:08

Target

Catalyst V5.exe
Size

78KB
MD5

7588e3039e0ec178557e1f4e8fd00f1a
SHA1

f79933d861349b51006fb36a57cf87d51bf620a9
SHA256

b9351151cb27d1032feae32c5750e65b8e4a47ea67ed86e15d2bc7bd42fd1a64
SHA512

13d8a4df568c0f1bc043d01d0f6014f6a4e40fe89de8d0df7c64b38206ffd45076b8ec435c3e98aab73e1fe6de4a09bc1524b53c2fb9bfe928d1ca8f82e5f88c
SSDEEP

1536:x2WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+oPI+:xZv5PDwbjNrmAE+sI+

Score

10^/10

Family

discordrat

Attributes

discord_token
MTIzODcwNDc5NzIzMDU2MzMzOA.Gl1Mb1.BOAMMTc11iWlaanZj7OcCPTr1tLRToM_Z9aYHY
server_id
1255836848048177255

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 1036	2368	Catalyst V5.exe	31
PID 2368 wrote to memory of 1036	2368	Catalyst V5.exe	31
PID 2368 wrote to memory of 1036	2368	Catalyst V5.exe	31

C:\Users\Admin\AppData\Local\Temp\Catalyst V5.exe
"C:\Users\Admin\AppData\Local\Temp\Catalyst V5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2368 -s 600
  2⤵
  PID:1036

memory/2368-0-0x000007FEF6793000-0x000007FEF6794000-memory.dmp

Filesize
4KB

Download
memory/2368-1-0x000000013F0B0000-0x000000013F0C8000-memory.dmp

Filesize
96KB

Download
memory/2368-2-0x000007FEF6790000-0x000007FEF717C000-memory.dmp

Filesize
9.9MB

Download
memory/2368-3-0x000007FEF6793000-0x000007FEF6794000-memory.dmp

Filesize
4KB

Download
memory/2368-4-0x000007FEF6790000-0x000007FEF717C000-memory.dmp

Filesize
9.9MB

Download