Overview
overview
7Static
static
3DiscordBot...64.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3$PLUGINSDIR/app-64.7z
windows10-2004-x64
7resources/...e.json
windows10-2004-x64
3resources/...ORY.md
windows10-2004-x64
3resources/...ICENSE
windows10-2004-x64
1resources/...e.json
windows10-2004-x64
3resources/...ICENSE
windows10-2004-x64
1resources/...js.map
windows10-2004-x64
3resources/...js.map
windows10-2004-x64
3resources/...js.map
windows10-2004-x64
3resources/...ICENSE
windows10-2004-x64
1resources/...js.map
windows10-2004-x64
3resources/...js.map
windows10-2004-x64
3resources/...js.map
windows10-2004-x64
3resources/...js.map
windows10-2004-x64
3resources/...js.map
windows10-2004-x64
3resources/...js.map
windows10-2004-x64
3resources/...js.map
windows10-2004-x64
3resources/...js.map
windows10-2004-x64
3resources/...js.map
windows10-2004-x64
3resources/...js.map
windows10-2004-x64
3resources/...ore.js
windows10-2004-x64
1resources/...son.js
windows10-2004-x64
1resources/...ins.js
windows10-2004-x64
1resources/...dex.js
windows10-2004-x64
1$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3$R0/Uninst...nt.exe
windows10-2004-x64
7Analysis
-
max time kernel
142s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06-04-2024 11:11
Static task
static1
Behavioral task
behavioral1
Sample
DiscordBotClient-win-x64.exe
Resource
win10v2004-20240319-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/app-64.7z
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
resources/app/node_modules/@protobuf-ts/runtime/package.json
Resource
win10v2004-20240226-en
Behavioral task
behavioral8
Sample
resources/app/node_modules/accepts/HISTORY.md
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
resources/app/node_modules/accepts/LICENSE
Resource
win10v2004-20240319-en
Behavioral task
behavioral10
Sample
resources/app/node_modules/accepts/package.json
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
resources/app/node_modules/ajv-formats/LICENSE
Resource
win10v2004-20240226-en
Behavioral task
behavioral12
Sample
resources/app/node_modules/ajv-formats/dist/formats.js.map
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
resources/app/node_modules/ajv-formats/dist/index.js.map
Resource
win10v2004-20240226-en
Behavioral task
behavioral14
Sample
resources/app/node_modules/ajv-formats/dist/limit.js.map
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
resources/app/node_modules/ajv-formats/node_modules/ajv/LICENSE
Resource
win10v2004-20240226-en
Behavioral task
behavioral16
Sample
resources/app/node_modules/ajv-formats/node_modules/ajv/dist/2019.js.map
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
resources/app/node_modules/ajv-formats/node_modules/ajv/dist/2020.js.map
Resource
win10v2004-20240319-en
Behavioral task
behavioral18
Sample
resources/app/node_modules/ajv-formats/node_modules/ajv/dist/ajv.js.map
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
resources/app/node_modules/ajv-formats/node_modules/ajv/dist/compile/codegen/code.js.map
Resource
win10v2004-20240226-en
Behavioral task
behavioral20
Sample
resources/app/node_modules/ajv-formats/node_modules/ajv/dist/compile/codegen/index.js.map
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
resources/app/node_modules/ajv-formats/node_modules/ajv/dist/compile/codegen/scope.js.map
Resource
win10v2004-20240226-en
Behavioral task
behavioral22
Sample
resources/app/node_modules/ajv-formats/node_modules/ajv/dist/compile/errors.js.map
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
resources/app/node_modules/ajv-formats/node_modules/ajv/dist/compile/index.js.map
Resource
win10v2004-20240226-en
Behavioral task
behavioral24
Sample
resources/app/node_modules/ajv-formats/node_modules/ajv/dist/compile/jtd/parse.js.map
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
resources/app/node_modules/ajv-formats/node_modules/ajv/dist/jtd.js.map
Resource
win10v2004-20240226-en
Behavioral task
behavioral26
Sample
resources/app/node_modules/conf/node_modules/ajv/lib/core.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
resources/app/node_modules/conf/node_modules/ajv/lib/runtime/parseJson.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral28
Sample
resources/app/node_modules/conf/node_modules/ajv/lib/vocabularies/applicator/contains.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
resources/app/node_modules/conf/node_modules/ajv/lib/vocabularies/discriminator/index.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240319-en
Behavioral task
behavioral31
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral32
Sample
$R0/Uninstall DiscordBotClient.exe
Resource
win10v2004-20240226-en
General
-
Target
resources/app/node_modules/ajv-formats/dist/index.js.map
-
Size
1KB
-
MD5
fdaeaa71d94ed99f9c0dfbc2567d21b9
-
SHA1
556eb14563e46ad8f9d0b5f94335a248fba93aba
-
SHA256
aaec578d5a2af589e3d726a6383198fa7b116b4e6c41900f4e5fb285bc9f6a67
-
SHA512
82eb509302ee0dbc6452c12761693571b07a5b5f54c117cf86303bc29d6482f55e8607f214cb0bce2492db62b457eab71cd3af22febf1cd1db63b735d0f8e74b
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings cmd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2888 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\resources\app\node_modules\ajv-formats\dist\index.js.map1⤵
- Modifies registry class
PID:3088
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2888