discordrat | 5d1c6f43553cfc3e034cca1ae788ea3cc25eb705e2f65ed1c234b70a42eac245

Resubmissions

22/02/2024, 14:30

240222-rvetyabe46 10

22/02/2024, 13:57

240222-q9ft4saf21 10

22/02/2024, 03:12

240222-dp961aba6v 10

Analysis

max time kernel
74s
max time network
86s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 14:30

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

menu.exe
Size

78KB
MD5

94b0cef834e50471c6d2a831aa79504f
SHA1

7618db2ba165475ebf98805a88839d4933cc8708
SHA256

5d1c6f43553cfc3e034cca1ae788ea3cc25eb705e2f65ed1c234b70a42eac245
SHA512

715b1fc4a3986dde8d0c901fed81b2a0241cd0dfc3e1ee04b73a7c2bc676ee5de420c84ab3b728950cdb95b4b0d407846114e811347ce42d3712083d58b45512
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+APIC:5Zv5PDwbjNrmAE+kIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIxMDAzNzcxMDkzNzM5OTMwNw.GD2MsQ.pb4P11_SfSpg7C_ciV50xHdtqk-mTgjk911dQ4
server_id
1210051148896018452

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\International\Geo\Nation	menu.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
35	discord.com
36	discord.com
37	discord.com
38	discord.com
43	discord.com
15	discord.com
16	discord.com
21	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "187"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2032	menu.exe
Token: SeShutdownPrivilege	4860	shutdown.exe
Token: SeRemoteShutdownPrivilege	4860	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4448	LogonUI.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 4860	2032	menu.exe	90
PID 2032 wrote to memory of 4860	2032	menu.exe	90

C:\Users\Admin\AppData\Local\Temp\menu.exe
"C:\Users\Admin\AppData\Local\Temp\menu.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\System32\shutdown.exe
  "C:\Windows\System32\shutdown.exe" /s /t 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4860

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa399f855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2032-0-0x000001DAF2DD0000-0x000001DAF2DE8000-memory.dmp

Filesize
96KB

Download
memory/2032-1-0x000001DAF53A0000-0x000001DAF5562000-memory.dmp

Filesize
1.8MB

Download
memory/2032-2-0x00007FFDC2110000-0x00007FFDC2BD1000-memory.dmp

Filesize
10.8MB

Download
memory/2032-3-0x000001DAF5290000-0x000001DAF52A0000-memory.dmp

Filesize
64KB

Download
memory/2032-4-0x000001DAF5BE0000-0x000001DAF6108000-memory.dmp

Filesize
5.2MB

Download
memory/2032-5-0x00007FFDC2110000-0x00007FFDC2BD1000-memory.dmp

Filesize
10.8MB

Download
memory/2032-6-0x000001DAF5290000-0x000001DAF52A0000-memory.dmp

Filesize
64KB

Download
memory/2032-7-0x00007FFDC2110000-0x00007FFDC2BD1000-memory.dmp

Filesize
10.8MB

Download