Analysis
-
max time kernel
1439s -
max time network
1443s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
01-11-2024 17:17
Behavioral task
behavioral1
Sample
Release/Discord rat.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Release/Discord rat.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
builder.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
builder.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
dnlib.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
dnlib.dll
Resource
win10v2004-20241007-en
General
-
Target
Release/Discord rat.exe
-
Size
79KB
-
MD5
d13905e018eb965ded2e28ba0ab257b5
-
SHA1
6d7fe69566fddc69b33d698591c9a2c70d834858
-
SHA256
2bd631c6665656673a923c13359b0dc211debc05b2885127e26b0dce808e2dec
-
SHA512
b95bfdebef33ac72b6c21cdf0abb4961222b7efd17267cd7236e731dd0b6105ece28e784a95455f1ffc8a6dd1d580a467b07b3bd8cb2fb19e2111f1a864c97cb
-
SSDEEP
1536:YCH0jBD2BKkwbPNrfxCXhRoKV6+V+y9viwp:VUjBD2BPwbPNrmAE+MqU
Malware Config
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Discord rat.exedescription pid process target process PID 2792 wrote to memory of 3012 2792 Discord rat.exe WerFault.exe PID 2792 wrote to memory of 3012 2792 Discord rat.exe WerFault.exe PID 2792 wrote to memory of 3012 2792 Discord rat.exe WerFault.exe