Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
03-11-2024 15:14
Behavioral task
behavioral1
Sample
625d168d569c3a3f72ce77aedab32c701c74675cb662feb088ad32424284c0f3N.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
625d168d569c3a3f72ce77aedab32c701c74675cb662feb088ad32424284c0f3N.exe
Resource
win10v2004-20241007-en
General
-
Target
625d168d569c3a3f72ce77aedab32c701c74675cb662feb088ad32424284c0f3N.exe
-
Size
78KB
-
MD5
03d5255de977b428e85fc050f50880b0
-
SHA1
d7bbb942d71b9685f1da2fadd748f09630fa0796
-
SHA256
625d168d569c3a3f72ce77aedab32c701c74675cb662feb088ad32424284c0f3
-
SHA512
a01b5a5ddf3ae469cfb37e99765f0431758cccbd5c265cda8841c860a100519fb52ea9a9b45ef89676e8c8121442e8086744157a732fc53deb68ab7b6b22e48d
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+YPIC:5Zv5PDwbjNrmAE+8IC
Malware Config
Extracted
discordrat
-
discord_token
MTI5NjM1MjUzMzg3ODY3MzQxOQ.G7K6xP.31um1OGg3LiuBJBOMNrTVm3txLG4MpTpULOdUM
-
server_id
1296355605455437887
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2108 wrote to memory of 2188 2108 625d168d569c3a3f72ce77aedab32c701c74675cb662feb088ad32424284c0f3N.exe 31 PID 2108 wrote to memory of 2188 2108 625d168d569c3a3f72ce77aedab32c701c74675cb662feb088ad32424284c0f3N.exe 31 PID 2108 wrote to memory of 2188 2108 625d168d569c3a3f72ce77aedab32c701c74675cb662feb088ad32424284c0f3N.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\625d168d569c3a3f72ce77aedab32c701c74675cb662feb088ad32424284c0f3N.exe"C:\Users\Admin\AppData\Local\Temp\625d168d569c3a3f72ce77aedab32c701c74675cb662feb088ad32424284c0f3N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2108 -s 6002⤵PID:2188
-