Overview
overview
7Static
static
3BetterDisc...ws.exe
windows7-x64
4BetterDisc...ws.exe
windows10-2004-x64
5$PLUGINSDI...ge.dll
windows7-x64
1$PLUGINSDI...ge.dll
windows10-2004-x64
1$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3BetterDiscord.exe
windows7-x64
5BetterDiscord.exe
windows10-2004-x64
7LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1d3dcompiler_47.dll
windows10-2004-x64
3ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
3libGLESv2.dll
windows10-2004-x64
3resources/app.js
windows7-x64
1resources/app.js
windows10-2004-x64
1swiftshade...GL.dll
windows7-x64
1swiftshade...GL.dll
windows10-2004-x64
1swiftshade...v2.dll
windows7-x64
1swiftshade...v2.dll
windows10-2004-x64
1vk_swiftshader.dll
windows7-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows7-x64
3vulkan-1.dll
windows10-2004-x64
3Analysis
-
max time kernel
159s -
max time network
192s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07-04-2024 19:00
Static task
static1
Behavioral task
behavioral1
Sample
BetterDiscord-Windows.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
BetterDiscord-Windows.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/BgImage.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/BgImage.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240319-en
Behavioral task
behavioral9
Sample
BetterDiscord.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
BetterDiscord.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
LICENSES.chromium.html
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
LICENSES.chromium.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral14
Sample
ffmpeg.dll
Resource
win7-20240221-en
Behavioral task
behavioral15
Sample
ffmpeg.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral16
Sample
libEGL.dll
Resource
win7-20240221-en
Behavioral task
behavioral17
Sample
libEGL.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral18
Sample
libGLESv2.dll
Resource
win7-20240220-en
Behavioral task
behavioral19
Sample
libGLESv2.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral20
Sample
resources/app.js
Resource
win7-20240221-en
Behavioral task
behavioral21
Sample
resources/app.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral22
Sample
swiftshader/libEGL.dll
Resource
win7-20231129-en
Behavioral task
behavioral23
Sample
swiftshader/libEGL.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral24
Sample
swiftshader/libGLESv2.dll
Resource
win7-20240221-en
Behavioral task
behavioral25
Sample
swiftshader/libGLESv2.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral26
Sample
vk_swiftshader.dll
Resource
win7-20240221-en
Behavioral task
behavioral27
Sample
vk_swiftshader.dll
Resource
win10v2004-20240319-en
Behavioral task
behavioral28
Sample
vulkan-1.dll
Resource
win7-20240221-en
Behavioral task
behavioral29
Sample
vulkan-1.dll
Resource
win10v2004-20240226-en
General
-
Target
BetterDiscord.exe
-
Size
112.3MB
-
MD5
673c5e8265f3f9c40e2fc8a4b56744e4
-
SHA1
5d0b271b850f0cd8e01229b1a72a2c1215bc7956
-
SHA256
43894debcd60fed8d64c1a724e60eb860a9d5453b3fc0529ecf9efdbc10a8128
-
SHA512
920c25220fe7d0b6b0079f9856d3931c3dcf93c8c6cf74f1ca1b3946a327093b24c03eb726b4344445b4d386847fc67e9dcf8550c20617a79df75b5d9c3e7483
-
SSDEEP
1572864:AzeRomoaC09nEiziYtpg0Ymr7owq3Ddn35FZevY4v034WZZB0HDh996O/fJaCJpw:geRomF3o3V/ZevY/CHHd+Iq
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
BetterDiscord.exeBetterDiscord.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Control Panel\International\Geo\Nation BetterDiscord.exe Key value queried \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Control Panel\International\Geo\Nation BetterDiscord.exe -
Processes:
BetterDiscord.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 BetterDiscord.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 BetterDiscord.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 BetterDiscord.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 BetterDiscord.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 BetterDiscord.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 BetterDiscord.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
BetterDiscord.exeBetterDiscord.exeBetterDiscord.exepid process 676 BetterDiscord.exe 268 BetterDiscord.exe 2440 BetterDiscord.exe 2440 BetterDiscord.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
BetterDiscord.exedescription pid process target process PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 2980 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 676 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 676 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 676 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 676 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 268 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 268 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 268 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 268 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 696 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 696 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 696 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 696 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 696 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 696 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 696 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 696 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 696 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 696 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 696 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 696 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 696 2440 BetterDiscord.exe BetterDiscord.exe PID 2440 wrote to memory of 696 2440 BetterDiscord.exe BetterDiscord.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BetterDiscord.exe"C:\Users\Admin\AppData\Local\Temp\BetterDiscord.exe"1⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\BetterDiscord.exe"C:\Users\Admin\AppData\Local\Temp\BetterDiscord.exe" --type=gpu-process --field-trial-handle=1048,14158512626241831487,14212840083046011488,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1056 /prefetch:22⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\BetterDiscord.exe"C:\Users\Admin\AppData\Local\Temp\BetterDiscord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1048,14158512626241831487,14212840083046011488,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1328 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:676 -
C:\Users\Admin\AppData\Local\Temp\BetterDiscord.exe"C:\Users\Admin\AppData\Local\Temp\BetterDiscord.exe" --type=renderer --field-trial-handle=1048,14158512626241831487,14212840083046011488,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1368 /prefetch:12⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:268 -
C:\Users\Admin\AppData\Local\Temp\BetterDiscord.exe"C:\Users\Admin\AppData\Local\Temp\BetterDiscord.exe" --type=gpu-process --field-trial-handle=1048,14158512626241831487,14212840083046011488,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1056 /prefetch:22⤵PID:696
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ca7ec134a378056005ea0a60825f963
SHA14005c647fea34beddf8241a60f27b8367fcf6a1a
SHA25603ee8fc019fc52a0c23bc715ff53e3f0ab98cc4b83727f160d732b30e7d70e15
SHA5128a466d115784749b821104c98805ae614762a10056a2b22fd64a5dcacd9e3d5d82ef6a72bcd54f8942aeab605deb65312e9e9bed9eb3b0dd11ca2e6ad6e5b3cb
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a