Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
05-12-2024 17:54
General
-
Target
hey spigga nigga @everyone.exe
-
Size
91KB
-
MD5
ea02e55219234d84f7edc015efd376ea
-
SHA1
9c1f4fcdda3890009d1301b34e61cf6d94bd91c6
-
SHA256
86bbe1727249f6583be9658d2d68c7eee7635c0d68facde070c82a38dfe09c31
-
SHA512
a938a62d9af850e2ce35f3f59841b0cae59e28fafbff69fa00bdd39b73a265801dc0bd39705a2526d06ce7d2c45bd3c026820a35e72d9b1314752b1905e66f24
-
SSDEEP
1536:oXKQ2FNJQ4FLHv1xCtRE9PLlX/k0SbIANrNaI+uexCxoKV6+f9ExR:XQsDQ4FLHKTE9D5/ZSbIANrNN+bS92
Malware Config
Extracted
discordrat
-
discord_token
AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAANkquobZQzEeoYHKoo4wB7AAAAAACAAAAAAAQZgAAAAEAACAAAAAoHOqVS9hOk58AbMxXOKMarWaWwwr5CC686pGFO0yAggAAAAAOgAAAAAIAACAAAABc9P9yem6CvWls70HVPxmbH0CUImLo2OEJpoTgHM7w1lAAAABBMpQbAvfC4PBd5+N0VsQqf8vXM3rhQ0s62GRBZZhHyHp9tvzssvGMkXjKCfOmjMdzc2PR7JEjzDPoxEN1UTHHxlLx6GrG47y5CIvn9a3g1UAAAABX9O1/x01YZkA+t0aLF8hAzujj9h+IGUGacXxMRcKHIwzS4qste5a9G5mDL/CUbPaTub2hMUnAkTwVQyGcko6o
-
server_id
1314287414537093211
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\hey spigga nigga @everyone.exe"C:\Users\Admin\AppData\Local\Temp\hey spigga nigga @everyone.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1996 -s 5282⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
112KB