discordrat | d8509ebf7284c41de1216b477c77b639a071cb34757695e45f92e8014b5afb32

Resubmissions

12-12-2024 20:14

11-12-2024 09:37

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
11-12-2024 09:37

Target

Megami Bootstrapper/Megami Tensai/Bootstrapper.exe
Size

78KB
MD5

ffd62c8367d0e9a94754d30b539375ba
SHA1

277ffd73105ff10e76925bde564847fe00417dbe
SHA256

fc4f75bd9d94a5079beada7947d2993ba793d9adb0499300362d4974641e160c
SHA512

122943f96bb9ef431eba70c6c5e7ea83234256021fc8f69a6e4d48bd1e8ab1f21d5bb0892d15d00139e87a95d9866429c8df59a6b87127f84039789ffa3702b5
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+VPIC:5Zv5PDwbjNrmAE+FIC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTMxNjMwNDYxNDMzMjgyNTYxMA.GfkKyi.futKLbxb-b4NGCE9C3S0QF42BNSIJ4UKJomCTY
server_id
1316299088035315712

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2336	2672	Bootstrapper.exe	31
PID 2672 wrote to memory of 2336	2672	Bootstrapper.exe	31
PID 2672 wrote to memory of 2336	2672	Bootstrapper.exe	31

C:\Users\Admin\AppData\Local\Temp\Megami Bootstrapper\Megami Tensai\Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Megami Bootstrapper\Megami Tensai\Bootstrapper.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2672 -s 600
  2⤵
  PID:2336

memory/2672-0-0x000007FEF60B3000-0x000007FEF60B4000-memory.dmp

Filesize
4KB

Download
memory/2672-1-0x000000013F8C0000-0x000000013F8D8000-memory.dmp

Filesize
96KB

Download
memory/2672-2-0x000007FEF60B0000-0x000007FEF6A9C000-memory.dmp

Filesize
9.9MB

Download
memory/2672-3-0x000007FEF60B0000-0x000007FEF6A9C000-memory.dmp

Filesize
9.9MB

Download