discordrat | c96573bd0c9534764e6a88b456512aaf3c0ec19c14254d2a522334808cb42c74

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25-09-2024 01:21

Target

VERYcuteprogram.exe
Size

78KB
MD5

e1ec9ed0862b27d3575596fa403e39c5
SHA1

6064d573422e497e64540c2e61e3eb38691d9ca0
SHA256

c96573bd0c9534764e6a88b456512aaf3c0ec19c14254d2a522334808cb42c74
SHA512

8886c6a2c03ae2bff4698d7e844af634ae9efdcdd70efd16b69c1c59a5328e47ac01357c6a0dd7ab5e9969ec02ab2168e63ad93a5c9e80148007dd8def240d53
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+9PIC:5Zv5PDwbjNrmAE+tIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI4NzA2NzA3OTQyMTMzMzY3Nw.G5id6S.t_4I43lW8iP-bca_4vzM5kzKpQP7JWZoR5HD40
server_id
1287094573918847180

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 1840	2368	VERYcuteprogram.exe	30
PID 2368 wrote to memory of 1840	2368	VERYcuteprogram.exe	30
PID 2368 wrote to memory of 1840	2368	VERYcuteprogram.exe	30

C:\Users\Admin\AppData\Local\Temp\VERYcuteprogram.exe
"C:\Users\Admin\AppData\Local\Temp\VERYcuteprogram.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2368 -s 596
  2⤵
  PID:1840

memory/2368-0-0x000007FEF6343000-0x000007FEF6344000-memory.dmp

Filesize
4KB

Download
memory/2368-1-0x000000013F460000-0x000000013F478000-memory.dmp

Filesize
96KB

Download
memory/2368-2-0x000007FEF6340000-0x000007FEF6D2C000-memory.dmp

Filesize
9.9MB

Download
memory/2368-3-0x000007FEF6343000-0x000007FEF6344000-memory.dmp

Filesize
4KB

Download
memory/2368-4-0x000007FEF6340000-0x000007FEF6D2C000-memory.dmp

Filesize
9.9MB

Download