9a189ff0ddec45af67b99c77726add8a2658f92ff807bcba0494a11a2ec6068e

Analysis

max time kernel
47s
max time network
16s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 11:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Discord-RAT-2.0
Size

274KB
MD5

4bc6f2724e8cd3ecd87db28e476a766a
SHA1

33204d32192b293806251a1e9b5ff3f29c62f57c
SHA256

9a189ff0ddec45af67b99c77726add8a2658f92ff807bcba0494a11a2ec6068e
SHA512

57eae14b45a30eb3bfbee17cc4c619c1e09e3c9c8b20849ad34f12f30ffe00ca6b1abb50abc82b46b04d6f5a8882089da589f081946c5efb8f4c391c9b56a435
SSDEEP

6144:yDuqJZfWZVSgE29xxspm0n1vuz3D9pvZJT3CqbMrhryfQNRPaCieMjAkvCJv1ViI:UfWZVSgE29xxspm0n1vuz3D9pvZJT3Cr

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\0_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\0_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.0	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.0\ = "0_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\0_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\0_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\0_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\0_auto_file\shell	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2712	AcroRd32.exe
2712	AcroRd32.exe
2712	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2760	2056	cmd.exe	29
PID 2056 wrote to memory of 2760	2056	cmd.exe	29
PID 2056 wrote to memory of 2760	2056	cmd.exe	29
PID 2760 wrote to memory of 2712	2760	rundll32.exe	30
PID 2760 wrote to memory of 2712	2760	rundll32.exe	30
PID 2760 wrote to memory of 2712	2760	rundll32.exe	30
PID 2760 wrote to memory of 2712	2760	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Discord-RAT-2.0
1⤵
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Discord-RAT-2.0
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Discord-RAT-2.0"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2ba39f7720cf4ea8091c42b2346fe368

SHA1
7bcb26fdc953c4ad9ae6cf125b2bd7a6544e34f1

SHA256
7cbb38fed06959cb08df7703a70000483c8e0f49e3d61ec836342dabc0512ec2

SHA512
ae8f107b53b003695cb03bb98212afbf119ceeadea8f2f3e7a7e4be4551ebcc11135ac565cf43f3179ea170476c08562832df12b03eaf3b355d9cf19f9b29388

Download Submit