Resubmissions
26/01/2025, 06:17
250126-g134lswjbr1026/01/2025, 00:44
250126-a3vrpawkay1025/01/2025, 07:43
250125-jkl69ssqat1025/01/2025, 06:18
250125-g2zsks1nck1007/11/2024, 17:59
241107-wksehawmb11007/11/2024, 17:59
241107-wksehawmbz06/11/2024, 11:31
241106-nm7m7szapg1005/11/2024, 22:04
241105-1y6aqsynhv1005/11/2024, 21:53
241105-1rm6ksyhqe1004/11/2024, 20:03
241104-ysp1fsvrfz10Analysis
- max time kernel
15s - max time network
16s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
- submitted
04/11/2024, 17:32
General
- Target ImageLogger-cleaned.exe
- Size 78KB
- Sample241104-v4bqestfnd
- SHA256 6a88e4cd73a6a4b7768b1df63aa7ff54d911568d3cd62d88c4b447cec1cb1ff2
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTI5NzUzOTkxNjAxNTg2NTkwNw.Gfdmm0.1DHqcqM266sEW3k8XieYxIORIkysBrFHb6r-3Q
-
server_id
1297365710649036921
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Discordrat family
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ImageLogger-cleaned.exe"C:\Users\Admin\AppData\Local\Temp\ImageLogger-cleaned.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1860 -s 5962⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1860-0-0x000007FEF5903000-0x000007FEF5904000-memory.dmp
memory/1860-1-0x000000013F7D0000-0x000000013F7E8000-memory.dmp
memory/1860-2-0x000007FEF5900000-0x000007FEF62EC000-memory.dmp
memory/1860-3-0x000007FEF5900000-0x000007FEF62EC000-memory.dmp