discordrat | 2e924669ad577c661d77a4ff8efd23a9a62efcfd0b499c8a0d741462656dca07

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-10-2024 05:30

Target

Yizzy menu 7.2.5.exe
Size

78KB
MD5

cfa4e068f22185a4d0f1d9c14af7b30e
SHA1

7b96e0915773d64350cd5b93bbe85ab4b4d1ab40
SHA256

2e924669ad577c661d77a4ff8efd23a9a62efcfd0b499c8a0d741462656dca07
SHA512

19900d7a08fccbbb56d78c088259028465d4f7f752118bbf099e48ab01904c716ef14c6e1b7e17a97d615730fe9d49dc150e16dae6fdd769120b9693adc58557
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+vPIC:5Zv5PDwbjNrmAE+XIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTI5ODUxNTU4NTMwNjcyNjQ2Mw.Gq0gUl.BFqro27n_tJQUE7N6u3vRu9oztd6vH8x7Wt7MU
server_id
1298515483619753984

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Yizzy menu 7.2.5.exe

description	pid	Process	procid_target
PID 1928 wrote to memory of 2904	1928	Yizzy menu 7.2.5.exe	30
PID 1928 wrote to memory of 2904	1928	Yizzy menu 7.2.5.exe	30
PID 1928 wrote to memory of 2904	1928	Yizzy menu 7.2.5.exe	30

C:\Users\Admin\AppData\Local\Temp\Yizzy menu 7.2.5.exe
"C:\Users\Admin\AppData\Local\Temp\Yizzy menu 7.2.5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1928 -s 596
  2⤵
  PID:2904

memory/1928-0-0x000007FEF5283000-0x000007FEF5284000-memory.dmp

Filesize
4KB

Download
memory/1928-1-0x000000013F970000-0x000000013F988000-memory.dmp

Filesize
96KB

Download
memory/1928-2-0x000007FEF5280000-0x000007FEF5C6C000-memory.dmp

Filesize
9.9MB

Download
memory/1928-3-0x000007FEF5283000-0x000007FEF5284000-memory.dmp

Filesize
4KB

Download
memory/1928-4-0x000007FEF5280000-0x000007FEF5C6C000-memory.dmp

Filesize
9.9MB

Download