Resubmissions
Analysis
-
max time kernel
84s -
max time network
85s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12-04-2024 03:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
malware.IshowMeat.jpg.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
malware.IshowMeat.jpg.exe
-
Size
320KB
-
MD5
2cadc43b860ca158894a3e129ac9a3b3
-
SHA1
0edb735c4b71f9d4c5a8ad80e58bdd6cd2ebe417
-
SHA256
0ba01b4d47a229a35b31ac87cb876c45cbc8e83a3911056c90cc0541a252533a
-
SHA512
0b30b0dc2b8fb20084fcce8bed2ac4422369464bc29ab6f1bef3a46f3908c6f839df7b3f0015df6b3f7eb61601fa23ed5739754dd3586cbe648d0b3a3c0954c8
-
SSDEEP
6144:/v5PDwbBrTIDMKCSNloqQ9EQRekoGcQyCpKzQm:/v51DM2bVmxmGcQyCH
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTIyNzAyMzc1NjE4MzIwNzk1Ng.GFySZ6.XX8JYM74wRYVqo3whA4s5qcCxIXvjlizI65gi4
-
server_id
1226407008819740715
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation malware.IshowMeat.jpg.exe -
Executes dropped EXE 1 IoCs
pid Process 2280 Localb_KsfrnAVt.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
flow ioc 9 discord.com 10 discord.com 24 discord.com 33 discord.com 34 discord.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2280 Localb_KsfrnAVt.exe Token: SeDebugPrivilege 2592 taskmgr.exe Token: SeSystemProfilePrivilege 2592 taskmgr.exe Token: SeCreateGlobalPrivilege 2592 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe 2592 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4056 wrote to memory of 2280 4056 malware.IshowMeat.jpg.exe 85 PID 4056 wrote to memory of 2280 4056 malware.IshowMeat.jpg.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\malware.IshowMeat.jpg.exe"C:\Users\Admin\AppData\Local\Temp\malware.IshowMeat.jpg.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Localb_KsfrnAVt.exe"C:\Users\Admin\AppData\Localb_KsfrnAVt.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2280
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2592
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD5b48bf2d78669d8220416e88d519315ad
SHA108ce075babd57f39e1be87054b88a8bbd7faea85
SHA25669a877c8742bcda936d47477171610f066bab2f7e626be3a380beb8af72d1d25
SHA5126848d22b8bd425cd15a043a773c6416202b4437a5ec90349479bf40cac84f2e65c7c5692a0e4a1d37a63e8397d949067ead4eb12e4677722d13e30074e9a7b59