discordrat | 2bd631c6665656673a923c13359b0dc211debc05b2885127e26b0dce808e2dec

Resubmissions

02/04/2024, 15:42

240402-s5e35aed8t 10

02/04/2024, 15:41

240402-s4smtsed6x 10

02/04/2024, 15:38

240402-s27c7see59 10

02/04/2024, 15:35

240402-s1jkraec7z 10

Analysis

max time kernel
91s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2024, 15:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fortnite.exe
Size

79KB
MD5

d13905e018eb965ded2e28ba0ab257b5
SHA1

6d7fe69566fddc69b33d698591c9a2c70d834858
SHA256

2bd631c6665656673a923c13359b0dc211debc05b2885127e26b0dce808e2dec
SHA512

b95bfdebef33ac72b6c21cdf0abb4961222b7efd17267cd7236e731dd0b6105ece28e784a95455f1ffc8a6dd1d580a467b07b3bd8cb2fb19e2111f1a864c97cb
SSDEEP

1536:YCH0jBD2BKkwbPNrfxCXhRoKV6+V+y9viwp:VUjBD2BPwbPNrmAE+MqU

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings	mspaint.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4056	vlc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
456	mspaint.exe
456	mspaint.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4056	vlc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2172	fortnite.exe
Token: SeManageVolumePrivilege	2020	svchost.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4056	vlc.exe
4056	vlc.exe
4056	vlc.exe
4056	vlc.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4056	vlc.exe
4056	vlc.exe
4056	vlc.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
456	mspaint.exe
3740	OpenWith.exe
4056	vlc.exe

C:\Users\Admin\AppData\Local\Temp\fortnite.exe
"C:\Users\Admin\AppData\Local\Temp\fortnite.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2172

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2020

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\SubmitRepair.jfif" /ForceBootstrapPaint3D
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:456

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:3524

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3740

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ClearTrace.wma"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2020-21-0x000001D859940000-0x000001D859950000-memory.dmp

Filesize
64KB

Download
memory/2020-41-0x000001D861D60000-0x000001D861D61000-memory.dmp

Filesize
4KB

Download
memory/2020-40-0x000001D861C50000-0x000001D861C51000-memory.dmp

Filesize
4KB

Download
memory/2020-39-0x000001D861C50000-0x000001D861C51000-memory.dmp

Filesize
4KB

Download
memory/2020-37-0x000001D861C20000-0x000001D861C21000-memory.dmp

Filesize
4KB

Download
memory/2020-5-0x000001D859840000-0x000001D859850000-memory.dmp

Filesize
64KB

Download
memory/2172-43-0x0000026A7F3D0000-0x0000026A7F3E0000-memory.dmp

Filesize
64KB

Download
memory/2172-4-0x0000026A00000000-0x0000026A00528000-memory.dmp

Filesize
5.2MB

Download
memory/2172-3-0x0000026A7F3D0000-0x0000026A7F3E0000-memory.dmp

Filesize
64KB

Download
memory/2172-2-0x00007FFFB7DE0000-0x00007FFFB88A1000-memory.dmp

Filesize
10.8MB

Download
memory/2172-1-0x0000026A7F500000-0x0000026A7F6C2000-memory.dmp

Filesize
1.8MB

Download
memory/2172-42-0x00007FFFB7DE0000-0x00007FFFB88A1000-memory.dmp

Filesize
10.8MB

Download
memory/2172-0-0x0000026A64EE0000-0x0000026A64EF8000-memory.dmp

Filesize
96KB

Download
memory/3524-59-0x0000023F20910000-0x0000023F20911000-memory.dmp

Filesize
4KB

Download
memory/3524-57-0x0000023F20910000-0x0000023F20911000-memory.dmp

Filesize
4KB

Download
memory/3524-55-0x0000023F20890000-0x0000023F20891000-memory.dmp

Filesize
4KB

Download
memory/3524-60-0x0000023F209A0000-0x0000023F209A1000-memory.dmp

Filesize
4KB

Download
memory/3524-61-0x0000023F209A0000-0x0000023F209A1000-memory.dmp

Filesize
4KB

Download
memory/3524-62-0x0000023F209B0000-0x0000023F209B1000-memory.dmp

Filesize
4KB

Download
memory/3524-63-0x0000023F209B0000-0x0000023F209B1000-memory.dmp

Filesize
4KB

Download
memory/4056-77-0x00007FF6CC0F0000-0x00007FF6CC1E8000-memory.dmp

Filesize
992KB

Download
memory/4056-78-0x00007FFFAEAA0000-0x00007FFFAEAD4000-memory.dmp

Filesize
208KB

Download
memory/4056-79-0x00007FFFADC50000-0x00007FFFADF04000-memory.dmp

Filesize
2.7MB

Download
memory/4056-80-0x00007FFFAC9A0000-0x00007FFFADA4B000-memory.dmp

Filesize
16.7MB

Download
memory/4056-81-0x00007FFFAC210000-0x00007FFFAC322000-memory.dmp

Filesize
1.1MB

Download