discordrat | a938ff9ba13e88cd2989b4e7c4ec27805242a5da86d23d6ff7fbe0a1a868ba4f

Resubmissions

24-03-2024 19:50

240324-ykgdcaff89 10

24-03-2024 19:45

240324-ygg6gaff62 10

Analysis

max time kernel
92s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-03-2024 19:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

6efc303244df90861ea895d5e32391ab
SHA1

58a6c06a60b2c5c9d54a78ef217fd7ed1edc7747
SHA256

a938ff9ba13e88cd2989b4e7c4ec27805242a5da86d23d6ff7fbe0a1a868ba4f
SHA512

e943190ca72652b912f30f8620ceb06a850502cc2c088583a82b27e18ce46a0f9f7312812b6cbeb1aa4d045b7349b6828f55e95fca60586bd210944e89f857a5
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+NPIC:5Zv5PDwbjNrmAE+dIC

Score

10^/10

discordrat bootkit persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIyMTU0MzQwNjU4MTMyMTc2OA.GnG4Nm.0S3-zLC_CuQZnYYEbaguj4NVMBsyRSCgReVpu8
server_id
1221543160388259971

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	MEMZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	MEMZ.exe

Executes dropped EXE 7 IoCs

pid	Process
6016	MEMZ.exe
5988	MEMZ.exe
5956	MEMZ.exe
2396	MEMZ.exe
5276	MEMZ.exe
3024	MEMZ.exe
2136	MEMZ.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
110	raw.githubusercontent.com
111	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133557834508382449"	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2248	chrome.exe
2248	chrome.exe
5956	MEMZ.exe
5988	MEMZ.exe
5956	MEMZ.exe
5988	MEMZ.exe
2396	MEMZ.exe
2396	MEMZ.exe
5956	MEMZ.exe
5956	MEMZ.exe
5988	MEMZ.exe
5988	MEMZ.exe
5276	MEMZ.exe
5276	MEMZ.exe
2396	MEMZ.exe
2396	MEMZ.exe
5988	MEMZ.exe
5988	MEMZ.exe
5956	MEMZ.exe
5956	MEMZ.exe
2396	MEMZ.exe
5276	MEMZ.exe
2396	MEMZ.exe
5276	MEMZ.exe
5988	MEMZ.exe
3024	MEMZ.exe
5988	MEMZ.exe
3024	MEMZ.exe
5956	MEMZ.exe
5956	MEMZ.exe
5276	MEMZ.exe
5276	MEMZ.exe
2396	MEMZ.exe
2396	MEMZ.exe
3024	MEMZ.exe
3024	MEMZ.exe
5988	MEMZ.exe
5988	MEMZ.exe
2396	MEMZ.exe
5276	MEMZ.exe
2396	MEMZ.exe
5276	MEMZ.exe
5956	MEMZ.exe
5956	MEMZ.exe
2396	MEMZ.exe
5276	MEMZ.exe
2396	MEMZ.exe
5276	MEMZ.exe
3024	MEMZ.exe
5988	MEMZ.exe
3024	MEMZ.exe
5988	MEMZ.exe
5956	MEMZ.exe
5956	MEMZ.exe
5956	MEMZ.exe
5956	MEMZ.exe
5988	MEMZ.exe
5988	MEMZ.exe
3024	MEMZ.exe
3024	MEMZ.exe
5276	MEMZ.exe
2396	MEMZ.exe
5276	MEMZ.exe
2396	MEMZ.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5492	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2564	Client-built.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe
Token: SeCreatePagefilePrivilege	2248	chrome.exe
Token: SeShutdownPrivilege	2248	chrome.exe

Suspicious use of FindShellTrayWindow 62 IoCs

pid	Process
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe

Suspicious use of SendNotifyMessage 52 IoCs

pid	Process
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
2248	chrome.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe
5492	taskmgr.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3024	MEMZ.exe
5276	MEMZ.exe
5988	MEMZ.exe
2396	MEMZ.exe
5988	MEMZ.exe
2396	MEMZ.exe
3024	MEMZ.exe
5276	MEMZ.exe
5276	MEMZ.exe
3024	MEMZ.exe
5988	MEMZ.exe
2396	MEMZ.exe
2396	MEMZ.exe
5988	MEMZ.exe
5276	MEMZ.exe
3024	MEMZ.exe
5276	MEMZ.exe
3024	MEMZ.exe
5988	MEMZ.exe
2396	MEMZ.exe
2396	MEMZ.exe
3024	MEMZ.exe
5988	MEMZ.exe
5276	MEMZ.exe
3024	MEMZ.exe
5276	MEMZ.exe
5988	MEMZ.exe
2396	MEMZ.exe
2396	MEMZ.exe
5988	MEMZ.exe
5276	MEMZ.exe
3024	MEMZ.exe
3024	MEMZ.exe
5988	MEMZ.exe
5276	MEMZ.exe
2396	MEMZ.exe
2396	MEMZ.exe
5988	MEMZ.exe
5276	MEMZ.exe
3024	MEMZ.exe
5276	MEMZ.exe
3024	MEMZ.exe
5988	MEMZ.exe
2396	MEMZ.exe
5276	MEMZ.exe
3024	MEMZ.exe
2396	MEMZ.exe
5988	MEMZ.exe
5988	MEMZ.exe
2396	MEMZ.exe
3024	MEMZ.exe
5276	MEMZ.exe
5276	MEMZ.exe
2396	MEMZ.exe
3024	MEMZ.exe
5988	MEMZ.exe
5988	MEMZ.exe
2396	MEMZ.exe
3024	MEMZ.exe
5276	MEMZ.exe
3024	MEMZ.exe
5276	MEMZ.exe
2396	MEMZ.exe
5988	MEMZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 3816	2248	chrome.exe	101
PID 2248 wrote to memory of 3816	2248	chrome.exe	101
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 4316	2248	chrome.exe	105
PID 2248 wrote to memory of 3824	2248	chrome.exe	106
PID 2248 wrote to memory of 3824	2248	chrome.exe	106
PID 2248 wrote to memory of 2836	2248	chrome.exe	107
PID 2248 wrote to memory of 2836	2248	chrome.exe	107
PID 2248 wrote to memory of 2836	2248	chrome.exe	107
PID 2248 wrote to memory of 2836	2248	chrome.exe	107
PID 2248 wrote to memory of 2836	2248	chrome.exe	107
PID 2248 wrote to memory of 2836	2248	chrome.exe	107
PID 2248 wrote to memory of 2836	2248	chrome.exe	107
PID 2248 wrote to memory of 2836	2248	chrome.exe	107
PID 2248 wrote to memory of 2836	2248	chrome.exe	107
PID 2248 wrote to memory of 2836	2248	chrome.exe	107
PID 2248 wrote to memory of 2836	2248	chrome.exe	107
PID 2248 wrote to memory of 2836	2248	chrome.exe	107
PID 2248 wrote to memory of 2836	2248	chrome.exe	107
PID 2248 wrote to memory of 2836	2248	chrome.exe	107
PID 2248 wrote to memory of 2836	2248	chrome.exe	107
PID 2248 wrote to memory of 2836	2248	chrome.exe	107
PID 2248 wrote to memory of 2836	2248	chrome.exe	107
PID 2248 wrote to memory of 2836	2248	chrome.exe	107
PID 2248 wrote to memory of 2836	2248	chrome.exe	107
PID 2248 wrote to memory of 2836	2248	chrome.exe	107
PID 2248 wrote to memory of 2836	2248	chrome.exe	107
PID 2248 wrote to memory of 2836	2248	chrome.exe	107

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2564

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb24ff9758,0x7ffb24ff9768,0x7ffb24ff9778
  2⤵
  PID:3816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1772 --field-trial-handle=1740,i,2094961941544854416,6859390562316372167,131072 /prefetch:2
  2⤵
  PID:4316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1740,i,2094961941544854416,6859390562316372167,131072 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2256 --field-trial-handle=1740,i,2094961941544854416,6859390562316372167,131072 /prefetch:8
  2⤵
  PID:2836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3124 --field-trial-handle=1740,i,2094961941544854416,6859390562316372167,131072 /prefetch:1
  2⤵
  PID:884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3136 --field-trial-handle=1740,i,2094961941544854416,6859390562316372167,131072 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4720 --field-trial-handle=1740,i,2094961941544854416,6859390562316372167,131072 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 --field-trial-handle=1740,i,2094961941544854416,6859390562316372167,131072 /prefetch:8
  2⤵
  PID:5496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5200 --field-trial-handle=1740,i,2094961941544854416,6859390562316372167,131072 /prefetch:8
  2⤵
  PID:5516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5216 --field-trial-handle=1740,i,2094961941544854416,6859390562316372167,131072 /prefetch:8
  2⤵
  PID:5672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5424 --field-trial-handle=1740,i,2094961941544854416,6859390562316372167,131072 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3220 --field-trial-handle=1740,i,2094961941544854416,6859390562316372167,131072 /prefetch:8
  2⤵
  PID:5500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3112 --field-trial-handle=1740,i,2094961941544854416,6859390562316372167,131072 /prefetch:1
  2⤵
  PID:5916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5884 --field-trial-handle=1740,i,2094961941544854416,6859390562316372167,131072 /prefetch:8
  2⤵
  PID:5536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5840 --field-trial-handle=1740,i,2094961941544854416,6859390562316372167,131072 /prefetch:8
  2⤵
  PID:3236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4712 --field-trial-handle=1740,i,2094961941544854416,6859390562316372167,131072 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5788 --field-trial-handle=1740,i,2094961941544854416,6859390562316372167,131072 /prefetch:8
  2⤵
  PID:1908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3320 --field-trial-handle=1740,i,2094961941544854416,6859390562316372167,131072 /prefetch:8
  2⤵
  PID:5088
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:6016
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:5988
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:5956
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2396
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:5276
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3024
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /main
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    PID:2136
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      PID:3412

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4128 --field-trial-handle=2264,i,13734085038406049477,12426093271221802693,262144 --variations-seed-version /prefetch:8
1⤵
PID:5204

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
1d13bf229cb6e8f2ccf00800902c2992

SHA1
3541ba801607712e54bd2011e68680daebb1d57e

SHA256
38e7704da4c83a611bdf28c5f874723bf2d9d4f86993fa5ed35fac0f1ca1ec26

SHA512
a2f32c1d57ed357a611c0eb3e0b59672894dae6f30141e45a15652494bee0f9f60e55d2f64ceb1f582b9dd17ff24ae2652f9befbe2f945820a88f1bb3ce82f9c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
a210e9aec6bff2a1a564354ab1883dce

SHA1
e540c13c40adfd789ae1b17ff659a37f057b0891

SHA256
90c80b7757b660f0cc0d5020c7321d53ea5ef4e685f4854c0c90181bdc500a37

SHA512
d115f213db8b51d33dd63e7cdc315919e99ae85306264bdaeb547fa6b3e5fa0c34e49ee3bca89c4dcdefe5d697a04b9aa2bbaec98accf6cd81d37501c0bcb537

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
9ee37e4da10009cdccfe5bd895a889bb

SHA1
9cf7732913a9f8b520acf5e990e997fe24b04f2f

SHA256
6068a3c56e354d304337f7245452071c08615d5ef7681a25b4bea807cb1fe365

SHA512
635f01ffcfef5d7fd9c17fa7bf7ae4d0d94e438924ebdad039242704640a7cc2701deca057007cc0af02f149e49f3c316777425023323e1cb7a74d0b016ec119

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
863B

MD5
f9a46bddaafa30bc407973a80e2b5619

SHA1
641f86609c002c6aed64967f696ca3f999c556d1

SHA256
87d66982fb2807f93a281a97e93cb71708d37e297df13d168f269b38b2ddcd30

SHA512
6b29163d000e96e513d1feeb463550555e0506acc49f2ff25449b5eee504ccf59b3ef25b6397137fc1382da7d3be5492e4d349938ae1256629c6f19c18aa1f37

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
367B

MD5
4a7ebf5a4083075adf0d362e0806ba16

SHA1
b952ed6b523a08f5fc7378f213aa73300bc8e684

SHA256
cde50c49502154c5eea000a4b5a8a81eb300aa5f59a18f9cc78f0a99ad6b8ae4

SHA512
a345677225a84637aeb6455b50af8c21ed18e861dd1aac2e8cd6b94bd4f9627c2ab4b54f591e98aa449a30035167ef4ec404c9ec28c57f8c743ad1c07aab4115

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
880145427c2daa71d0712a2551240102

SHA1
cbeeb3d6fee909904cba009fe21cb35f7d463c1b

SHA256
9467fae3db673d781dda62e34238fee242e1ca23c5c07aaac8da62ceac6c92bc

SHA512
8d3780295425028c67d12571f47eb7a6fdc27a292aee42132c12d9570fdeefe4b7f86db56de0670512e8a30f951bd41443041503325343a750b9ce2a3294386b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
532B

MD5
c7ac9f770c8b5e45a4fc3acaeb96e4f3

SHA1
6fc1cc0cd603d611e8ca845e34580e71917829e8

SHA256
01fd88394b2f01af8628f38691b54968dc62582f5f31143c0d1e80d637f5e617

SHA512
402cdc1e2948fe76ac8d8f7efed285fde2040bd7f33299a0063852294942ba5fc78b5e910a349b003956fd544cb8ba3014a160621804730b71c67d0c7dbcd70b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
276bf56f57406b61c646a4d013674634

SHA1
7a380f33fa90d2a6ba1a0641607a660f9da1373d

SHA256
bb4a38bd361690f9924eee343112b522f10623d5c08b2d15ef072a068ec66607

SHA512
6da0da7cca8b45823a3db4e88c233fc4f81f76e7f32ce8a53a6c9fc5015d28a6bd77c69b25711d2a0886e4d0d0ce7ec077579ced9787ad9043455ceca71019e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
fff35cd282f22232a929a12aff5f0787

SHA1
f9502c7f444ec8de57bdc92c689d594aa121e51c

SHA256
e57f3fb214c9f06c63b3a534e32b42e676b3e570f29d2d92d09303f702c7ce53

SHA512
f1fcd6dfe63d2c6796b365976797f8619a9d1372610244bd44e174954469d850b8896259284a8f9e0f7ff8e4bcfe6ca49c3ee38de9383c10a6c24c15934df95d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
5614c8cbdedb1e673e1c4fdbd7ff7020

SHA1
d17980bb808a2a65f02a10701dcad118a52bf94d

SHA256
7736fe9ada8970df3024b5404c98ac44f44b6cac6b25cc9c16d7f3f375314961

SHA512
b38430b79e68bb732cde9a49e194be6cf97c4321dffd37497ea33fedba11dac8a1875771b79a5bc6caddfa93f3b9f96d6b0781ca3541988c02d035e1096f2891

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
918b492634f5757051430cbb21be5c7b

SHA1
6858cb580d225b54d2db4338ed1505f8cffc3ada

SHA256
acae8957e764be7d54c2db6e13c5edb2448f901f142b7ed21705f9d8b0e6474f

SHA512
fe2f6874b2728092e1e100eb8a60bb20ae6f82cd975766cc6e5de55299554499e41b6e483cd34117ee108da22dabd52141c28d9f4c190c06ac8f95d96952c385

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
42f44c4e86e4e3c4368f8a495127cb7a

SHA1
c5b339275a848995f553bd9778e2564265720771

SHA256
74a2d3cf1af2b28e0dc4005e843d9d04da8055855e79641ecf355cf9c14f7ef3

SHA512
60a0604229141d105022bd1b3130f7a9c14a031f9cf59aed057c5bb4628da43d14eb17c58a334a54956c6df3fb33ab3704345bc0f4c54c42e0ef32e1799a8317

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
258KB

MD5
b8ebcaf3ab8e1d1c88b66419be138c11

SHA1
ec2054b9669acbe964caebc051063a026f1d8759

SHA256
7fa0a74a73d2b35ed88fe3ae9add589dd86786f0f9c2fc3c1e868429303c7937

SHA512
955c7fd9644c0971e5ef7d29ca5b35cd41d3d8141666fb5ec47544a90674fbdf7519d63e36e277829ff4c2a39b401a5c83f938154837007675c2efaab93130aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
114KB

MD5
b94b733a01efb9fb822f3bca632f9316

SHA1
06f1210a3d1ee75e4a0b6b7fc51781f6fe43227a

SHA256
7364a3c92dd6c6e90549a7a053edcf6dd78abc28a224e756aeac40981b33d0dc

SHA512
7d81a931f2e266427860ea2431d77ce25ab2d585a2584db4e24140cde1c76da21f288c4dfeded1dd2e0b27ea5936c81050bcc35ab75130e97fe19d307914581c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
101KB

MD5
275abfd86af6f9fd0f0cb2db3a7ef0d2

SHA1
ab6600ce962ac28c1e8b038c1e9227096f5d05e0

SHA256
cd474ddf4b30813dc3804c2a606f938fe75438d39da8724f9e2a504f20d46279

SHA512
789b531673658afae46e931da0d0aa698e1d48edd39c9bca14caa951b4d8fec6b2344755bfaea347875d961e34ed189cac25398efe01b420c53bf024a0643dbc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5860d8.TMP

Filesize
96KB

MD5
f06a682182cdc0306a87e3a5ba8da503

SHA1
d9983169ef0cdc0c8cd70bfa11547a7308287d68

SHA256
514ffbda9a71a3536f620512b072dd546044c793b678b2a477da5e9b70db6414

SHA512
7fc08b0b42b68e6b842853ef3417edf695ce41fc734461fed4e5bbc4fb76246fcf5a8b6f58a1c54ea79c7d8eab399a13995cc7859ad04c3bd7207401088aba5e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\Downloads\MEMZ.exe

Filesize
16KB

MD5
1d5ad9c8d3fee874d0feb8bfac220a11

SHA1
ca6d3f7e6c784155f664a9179ca64e4034df9595

SHA256
3872c12d31fc9825e8661ac01ecee2572460677afbc7093f920a8436a42e28ff

SHA512
c8246f4137416be33b6d1ac89f2428b7c44d9376ac8489a9fbf65ef128a6c53fb50479e1e400c8e201c8611992ab1d6c1bd3d6cece89013edb4d35cdd22305b1

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
memory/2564-3-0x000001B245DB0000-0x000001B245DC0000-memory.dmp

Filesize
64KB

Download
memory/2564-4-0x000001B246830000-0x000001B246D58000-memory.dmp

Filesize
5.2MB

Download
memory/2564-24-0x000001B245DC0000-0x000001B245EC2000-memory.dmp

Filesize
1.0MB

Download
memory/2564-0-0x000001B22B860000-0x000001B22B878000-memory.dmp

Filesize
96KB

Download
memory/2564-62-0x000001B245DB0000-0x000001B245DC0000-memory.dmp

Filesize
64KB

Download
memory/2564-61-0x00007FFB30B10000-0x00007FFB315D1000-memory.dmp

Filesize
10.8MB

Download
memory/2564-2-0x00007FFB30B10000-0x00007FFB315D1000-memory.dmp

Filesize
10.8MB

Download
memory/2564-1-0x000001B245EF0000-0x000001B2460B2000-memory.dmp

Filesize
1.8MB

Download
memory/5492-336-0x000001FD857D0000-0x000001FD857D1000-memory.dmp

Filesize
4KB

Download
memory/5492-334-0x000001FD857D0000-0x000001FD857D1000-memory.dmp

Filesize
4KB

Download
memory/5492-340-0x000001FD857D0000-0x000001FD857D1000-memory.dmp

Filesize
4KB

Download
memory/5492-341-0x000001FD857D0000-0x000001FD857D1000-memory.dmp

Filesize
4KB

Download
memory/5492-342-0x000001FD857D0000-0x000001FD857D1000-memory.dmp

Filesize
4KB

Download
memory/5492-344-0x000001FD857D0000-0x000001FD857D1000-memory.dmp

Filesize
4KB

Download
memory/5492-345-0x000001FD857D0000-0x000001FD857D1000-memory.dmp

Filesize
4KB

Download
memory/5492-343-0x000001FD857D0000-0x000001FD857D1000-memory.dmp

Filesize
4KB

Download
memory/5492-346-0x000001FD857D0000-0x000001FD857D1000-memory.dmp

Filesize
4KB

Download
memory/5492-335-0x000001FD857D0000-0x000001FD857D1000-memory.dmp

Filesize
4KB

Download