Overview
overview
10Static
static
10Main/CED3D10Hook.dll
windows7-x64
1Main/CED3D10Hook.dll
windows10-2004-x64
1Main/CED3D...64.dll
windows7-x64
1Main/CED3D...64.dll
windows10-2004-x64
1Main/CED3D11Hook.dll
windows7-x64
1Main/CED3D11Hook.dll
windows10-2004-x64
1Main/CED3D...64.dll
windows7-x64
1Main/CED3D...64.dll
windows10-2004-x64
1Main/RUN_ME.bat
windows7-x64
10Main/RUN_ME.bat
windows10-2004-x64
10Main/autor...oup.js
windows7-x64
1Main/autor...oup.js
windows10-2004-x64
1Main/autor...ace.js
windows7-x64
1Main/autor...ace.js
windows10-2004-x64
1Main/autor...nfo.js
windows7-x64
1Main/autor...nfo.js
windows10-2004-x64
1Main/autor...rch.js
windows7-x64
1Main/autor...rch.js
windows10-2004-x64
1Main/autor...log.js
windows7-x64
1Main/autor...log.js
windows10-2004-x64
1Main/autor...ols.js
windows7-x64
1Main/autor...ols.js
windows10-2004-x64
1Main/autor...ave.js
windows7-x64
1Main/autor...ave.js
windows10-2004-x64
1Main/autor...yce.js
windows7-x64
1Main/autor...yce.js
windows10-2004-x64
1Main/autor...ian.js
windows7-x64
1Main/autor...ian.js
windows10-2004-x64
1Main/autor...are.js
windows7-x64
1Main/autor...are.js
windows10-2004-x64
1Main/autor...unt.js
windows7-x64
1Main/autor...unt.js
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12-03-2024 15:59
Behavioral task
behavioral1
Sample
Main/CED3D10Hook.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Main/CED3D10Hook.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
Main/CED3D10Hook64.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Main/CED3D10Hook64.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Main/CED3D11Hook.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Main/CED3D11Hook.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Main/CED3D11Hook64.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Main/CED3D11Hook64.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Main/RUN_ME.bat
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
Main/RUN_ME.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
Main/autorun/AddToNewGroup.js
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Main/autorun/AddToNewGroup.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
Main/autorun/DotNetInterface.js
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
Main/autorun/DotNetInterface.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
Main/autorun/JavaInfo.js
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
Main/autorun/JavaInfo.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
Main/autorun/JavaSearch.js
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
Main/autorun/JavaSearch.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
Main/autorun/MethodInvokeDialog.js
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
Main/autorun/MethodInvokeDialog.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
Main/autorun/andtools.js
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
Main/autorun/andtools.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
Main/autorun/autosave.js
Resource
win7-20240220-en
Behavioral task
behavioral24
Sample
Main/autorun/autosave.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
Main/autorun/babyce.js
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
Main/autorun/babyce.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
Main/autorun/bigendian.js
Resource
win7-20231129-en
Behavioral task
behavioral28
Sample
Main/autorun/bigendian.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
Main/autorun/ceshare.js
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
Main/autorun/ceshare.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
Main/autorun/ceshare/ceshare_account.js
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
Main/autorun/ceshare/ceshare_account.js
Resource
win10v2004-20240226-en
General
-
Target
Main/RUN_ME.bat
-
Size
20B
-
MD5
e33b065e04e13f92aa194ddb6f7bb9d8
-
SHA1
0c651171deee149f84e8feee2eeef678ee19b581
-
SHA256
a2ff24b8dbd5f24390c24092f83b2deaadae82bc588e50ca1c618b22ee3f8ec2
-
SHA512
155d0a18ffac00414250061c1010508a9c7b512dd0b0910a154655dc9e0e0dc5950762776c3c8195ad28797a661d49e25c5e2496e217457f8824bb58a7805b3a
Malware Config
Extracted
discordrat
-
discord_token
MTIxNzA3NzI2Njc5OTEzMjc5NA.GAOYV3.xQnTqmmpoLSHwXaVIJBtj8iVivEgiNDnLOt_Pw
-
server_id
1190067527355744316
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs
Processes:
flow ioc 8 discord.com 10 discord.com 41 discord.com 222 discord.com 235 discord.com 236 discord.com 258 discord.com 260 discord.com -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
build.exedescription pid process Token: SeDebugPrivilege 1584 build.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
cmd.exebuild.exedescription pid process target process PID 4860 wrote to memory of 1584 4860 cmd.exe build.exe PID 4860 wrote to memory of 1584 4860 cmd.exe build.exe PID 1584 wrote to memory of 4732 1584 build.exe SCHTASKS.exe PID 1584 wrote to memory of 4732 1584 build.exe SCHTASKS.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Main\RUN_ME.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\Main\build.exebuild.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SYSTEM32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77build.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\Main\build.exe'" /sc onlogon /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:4732
-
-