Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
22-10-2021 00:45
Static task
static1
Behavioral task
behavioral1
Sample
DiscordSniper.exe
Resource
win7-en-20210920
General
-
Target
DiscordSniper.exe
-
Size
57KB
-
MD5
df01a8c7077dbe40e68979f486ad29a7
-
SHA1
0f335a9a6ead9b8961a57bc724c93fb672ec14cb
-
SHA256
d361b54090cffa37e08b270d91a6fa1aec4f78347f38ba930328c84733a233cb
-
SHA512
ddca81cffd4abb81b405490f94e61a2c8a5f332796ad66e2f3b1add9d53138a55dc65a3c346e9eafa35fdd49f8035a75019988c6594f3d837cd6c006455d3601
Malware Config
Signatures
-
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
DiscordSniper.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion DiscordSniper.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 10 ip-api.com -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
DiscordSniper.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum DiscordSniper.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 DiscordSniper.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1096 1880 WerFault.exe DiscordSniper.exe -
Checks SCSI registry key(s) 3 TTPs 1 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
DiscordSniper.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S DiscordSniper.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
DiscordSniper.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 DiscordSniper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString DiscordSniper.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
Processes:
DiscordSniper.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0 DiscordSniper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation DiscordSniper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer DiscordSniper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName DiscordSniper.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
WerFault.exepid process 1096 WerFault.exe 1096 WerFault.exe 1096 WerFault.exe 1096 WerFault.exe 1096 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WerFault.exepid process 1096 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
DiscordSniper.exeWerFault.exedescription pid process Token: SeDebugPrivilege 1880 DiscordSniper.exe Token: SeDebugPrivilege 1096 WerFault.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
DiscordSniper.exedescription pid process target process PID 1880 wrote to memory of 1096 1880 DiscordSniper.exe WerFault.exe PID 1880 wrote to memory of 1096 1880 DiscordSniper.exe WerFault.exe PID 1880 wrote to memory of 1096 1880 DiscordSniper.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DiscordSniper.exe"C:\Users\Admin\AppData\Local\Temp\DiscordSniper.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1880 -s 19242⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1096-57-0x0000000000000000-mapping.dmp
-
memory/1096-58-0x000007FEFBFC1000-0x000007FEFBFC3000-memory.dmpFilesize
8KB
-
memory/1096-59-0x0000000001B80000-0x0000000001B81000-memory.dmpFilesize
4KB
-
memory/1880-54-0x0000000000300000-0x0000000000301000-memory.dmpFilesize
4KB
-
memory/1880-56-0x000000001AE10000-0x000000001AE12000-memory.dmpFilesize
8KB