discordrat | ab89b88da095ccb90bfef2ca1bba709a28bdceceffc41241e21b8fc24ec68ef8

Analysis

max time kernel
91s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
24-08-2024 16:00

Target

celestic.exe
Size

78KB
MD5

038faf7b553b5f29ebfa1c000ae225b8
SHA1

de8dd46c92b81dc6e00d61e72612ba81e73a431e
SHA256

ab89b88da095ccb90bfef2ca1bba709a28bdceceffc41241e21b8fc24ec68ef8
SHA512

9c088f152fcf24993830e7696540afd2d50a6540a44f0d8584a5066a984b0e4f32bd0e60cfabadb9696ad048a5fc82616563639ab4bd7d75e75c606f394cca14
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+APIC:5Zv5PDwbjNrmAE+kIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI3NDA2MDk5NjEyMTcyMzAzMA.GU7_bO.PQQWKKCz2jDyxsje_hCfYCqcJYeKTnPTcs2E8I
server_id
1274060797798252645

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 1620	2464	celestic.exe	30
PID 2464 wrote to memory of 1620	2464	celestic.exe	30
PID 2464 wrote to memory of 1620	2464	celestic.exe	30

C:\Users\Admin\AppData\Local\Temp\celestic.exe
"C:\Users\Admin\AppData\Local\Temp\celestic.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2464 -s 600
  2⤵
  PID:1620

memory/2464-0-0x000007FEF5AF3000-0x000007FEF5AF4000-memory.dmp

Filesize
4KB

Download
memory/2464-1-0x000000013F790000-0x000000013F7A8000-memory.dmp

Filesize
96KB

Download
memory/2464-2-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

Filesize
9.9MB

Download
memory/2464-3-0x000007FEF5AF3000-0x000007FEF5AF4000-memory.dmp

Filesize
4KB

Download
memory/2464-4-0x000007FEF5AF0000-0x000007FEF64DC000-memory.dmp

Filesize
9.9MB

Download