Analysis
- max time kernel
118s - max time network
119s - platform
windows7_x64 - resource
win7-20240729-en - resource tags
- submitted
08/09/2024, 07:27
General
- Target FPS+.exe
- Size 78KB
- Sample240908-jagh2atcpp
- SHA256 6d1703bd786779f40dbb4cfd0de3e39ed7f09afcb8e3555aabc1bf6839ccb4da
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTI4MjIzOTgwNDU4NjU5NDMxOQ.GEkcj7.DZZa25XaQvgv-ZVRs-HJbbZyRm7z_fvhKTVxyU
-
server_id
1282239514231701626
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FPS+.exe"C:\Users\Admin\AppData\Local\Temp\FPS+.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2488 -s 5962⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2488-0-0x000007FEF4EE3000-0x000007FEF4EE4000-memory.dmp
memory/2488-1-0x000000013FD80000-0x000000013FD98000-memory.dmp
memory/2488-2-0x000007FEF4EE0000-0x000007FEF58CC000-memory.dmp
memory/2488-3-0x000007FEF4EE0000-0x000007FEF58CC000-memory.dmp