discordrat | caaf43b82fc39e464005e56f4334a2ffb68d42949687c835c9d3385126af0fab

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/09/2024, 05:10

Target
caaf43b82fc39e464005e56f4334a2ffb68d42949687c835c9d3385126af0fab.exe
Size 133KB
Sample240920-ftte6azepd
SHA256 caaf43b82fc39e464005e56f4334a2ffb68d42949687c835c9d3385126af0fab
MD5 95f1b3db3f20fa8d39d0becaf62a2382
SHA1 8f172757c90e99b36a6c88caa1dfd7dcc8d36576
SHA512 ad37bdeb428e6ac4acf44f7e4852eb5e107a91d8937d848a5bcfcbf91ab4ef266e5f0704e711713660a2c0e7a35e7c86538d7a76c12b51691e7442204a93768c
SSDEEP 1536:62WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+7PIHxrq7ijr:6Zv5PDwbjNrmAE+zIE7iP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Attributes

discord_token
MTI4NjM1MTAxNTMyMjQ1NjA4NQ.G554Sc.ny0RfKCv1Nk9qm4Lto4vbnjcXCnSEgyfISBGi8
server_id
1286350925296042046

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 1524	2848	caaf43b82fc39e464005e56f4334a2ffb68d42949687c835c9d3385126af0fab.exe	31
PID 2848 wrote to memory of 1524	2848	caaf43b82fc39e464005e56f4334a2ffb68d42949687c835c9d3385126af0fab.exe	31
PID 2848 wrote to memory of 1524	2848	caaf43b82fc39e464005e56f4334a2ffb68d42949687c835c9d3385126af0fab.exe	31

C:\Users\Admin\AppData\Local\Temp\caaf43b82fc39e464005e56f4334a2ffb68d42949687c835c9d3385126af0fab.exe
"C:\Users\Admin\AppData\Local\Temp\caaf43b82fc39e464005e56f4334a2ffb68d42949687c835c9d3385126af0fab.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2848 -s 596
  2⤵
  PID:1524

memory/2848-0-0x000007FEF5BE3000-0x000007FEF5BE4000-memory.dmp

Download

memory/2848-1-0x000000013FCE0000-0x000000013FD06000-memory.dmp

Download

memory/2848-2-0x000007FEF5BE0000-0x000007FEF65CC000-memory.dmp

Download

memory/2848-3-0x000007FEF5BE3000-0x000007FEF5BE4000-memory.dmp

Download