Resubmissions

13-04-2024 08:34

240413-kgl8jacd83 10

Analysis

  • max time kernel
    43s
  • max time network
    48s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-04-2024 08:34

General

  • Target

    https://mega.nz/folder/xdQ2CDCK#i3feM8SWjoA9XvLZGJHuLw

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    ODU5MTIyNTI5NzQyNjE4NjM1.Gd2TNx.k4_Wl6MAIrDVzPW95UrYQBEz4yKbJ7tOFjiQfg

  • server_id

    1228604538785763368

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

  • Executes dropped EXE 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/folder/xdQ2CDCK#i3feM8SWjoA9XvLZGJHuLw
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3716
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97a1946f8,0x7ff97a194708,0x7ff97a194718
      2⤵
        PID:1984
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,18195344454296096250,9044265001330158770,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
        2⤵
          PID:4212
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,18195344454296096250,9044265001330158770,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2948
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,18195344454296096250,9044265001330158770,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
          2⤵
            PID:1936
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,18195344454296096250,9044265001330158770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
            2⤵
              PID:4344
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,18195344454296096250,9044265001330158770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
              2⤵
                PID:1524
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2060,18195344454296096250,9044265001330158770,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4032 /prefetch:8
                2⤵
                  PID:4784
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,18195344454296096250,9044265001330158770,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5748 /prefetch:8
                  2⤵
                    PID:400
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,18195344454296096250,9044265001330158770,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5748 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3844
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2060,18195344454296096250,9044265001330158770,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5136 /prefetch:8
                    2⤵
                      PID:3180
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,18195344454296096250,9044265001330158770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
                      2⤵
                        PID:4664
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2060,18195344454296096250,9044265001330158770,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6264 /prefetch:8
                        2⤵
                          PID:1760
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2060,18195344454296096250,9044265001330158770,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6092 /prefetch:8
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4916
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,18195344454296096250,9044265001330158770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:1
                          2⤵
                            PID:1896
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,18195344454296096250,9044265001330158770,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
                            2⤵
                              PID:1044
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,18195344454296096250,9044265001330158770,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
                              2⤵
                                PID:4480
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,18195344454296096250,9044265001330158770,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
                                2⤵
                                  PID:1840
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:5004
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:4992
                                  • C:\Windows\system32\AUDIODG.EXE
                                    C:\Windows\system32\AUDIODG.EXE 0x33c 0x4c0
                                    1⤵
                                      PID:2040
                                    • C:\Windows\System32\rundll32.exe
                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                      1⤵
                                        PID:720
                                      • C:\Users\Admin\Downloads\Wave.exe
                                        "C:\Users\Admin\Downloads\Wave.exe"
                                        1⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:5184
                                      • C:\Users\Admin\Downloads\Wave.exe
                                        "C:\Users\Admin\Downloads\Wave.exe"
                                        1⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:5676

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                        Filesize

                                        152B

                                        MD5

                                        e36b219dcae7d32ec82cec3245512f80

                                        SHA1

                                        6b2bd46e4f6628d66f7ec4b5c399b8c9115a9466

                                        SHA256

                                        16bc6f47bbfbd4e54c3163dafe784486b72d0b78e6ea3593122edb338448a27b

                                        SHA512

                                        fc539c461d87141a180cf71bb6a636c75517e5e7226e76b71fd64e834dcacc88fcaaa92a9a00999bc0afc4fb93b7304b068000f14653c05ff03dd7baef3f225c

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                        Filesize

                                        152B

                                        MD5

                                        559ff144c30d6a7102ec298fb7c261c4

                                        SHA1

                                        badecb08f9a6c849ce5b30c348156b45ac9120b9

                                        SHA256

                                        5444032cb994b90287c0262f2fba16f38e339073fd89aa3ab2592dfebc3e6f10

                                        SHA512

                                        3a45661fc29e312aa643a12447bffdab83128fe5124077a870090081af6aaa4cf0bd021889ab1df5cd40f44adb055b1394b31313515c2929f714824c89fd0f04

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                        Filesize

                                        72B

                                        MD5

                                        dbde221d6d03901ae1e6077eabaa8d41

                                        SHA1

                                        93b0d8684990de5bce5ab0ac78e827641f6f4f4b

                                        SHA256

                                        efcabac31520a6378521ec180708d717962b4fb18833bb3b32d0ca9589a4dad9

                                        SHA512

                                        8b9bf80177b80955d395e9dec869429f1fe1f39961663f52672d2d5f61bf87a124ac9e1e9e4fc503d629877b9dfe0fc8dbf81c2d3883d8e722c8719f67850977

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT

                                        Filesize

                                        16B

                                        MD5

                                        46295cac801e5d4857d09837238a6394

                                        SHA1

                                        44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                        SHA256

                                        0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                        SHA512

                                        8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                        Filesize

                                        6KB

                                        MD5

                                        d0cb3dcb68db239e2ebd5a7019002083

                                        SHA1

                                        9ea6059933fb87f4f37cb183ff1212f17b8e4134

                                        SHA256

                                        a0a8e6ec95548fe972f826753dfa15f58ffb5ea495b431bc3b9e284e3ad7f450

                                        SHA512

                                        4240b190f17ded9f68916099693dfc953b27307bdb09470252faa0960a6110ca00c4d9cefa44c1cde78a08069b20f7f6b7e171af5b2d38f7b637098df3c27e98

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                        Filesize

                                        6KB

                                        MD5

                                        09f445e8a7f5c0fb9209d20fa9cbaa95

                                        SHA1

                                        46b50d2f0e1c71130ed378a84b11b38e2ab013d9

                                        SHA256

                                        cdc32d68122e85031d22b26bdd9f652c856ed1475c16e12860fc2fb8623cc68c

                                        SHA512

                                        ee388990c185c393fb1657c59cc81e9e6fbb50bed1ac5a177eb150916c2059493224dd1fad9eb3d3a51f8ad328bf59b7908dcec555505ca2f3b8e8c90e6814b1

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                        Filesize

                                        6KB

                                        MD5

                                        6750939eb8657943c549c984af034758

                                        SHA1

                                        053668e42747d913a3ce4c57ae6ca11136b5d2e4

                                        SHA256

                                        b0c5349cae839c462b7e373f8fdf9a69c81b922e3658ed29e2aa1487e8f71677

                                        SHA512

                                        41e3295eeec14e34293c6880ef3677dc12556a97dd374c02604a154bc5efced470a9878058c51d9097fa0e287d56189283d36744bdc29a0411d4a8bfee650076

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

                                        Filesize

                                        41B

                                        MD5

                                        5af87dfd673ba2115e2fcf5cfdb727ab

                                        SHA1

                                        d5b5bbf396dc291274584ef71f444f420b6056f1

                                        SHA256

                                        f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                        SHA512

                                        de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                        Filesize

                                        72B

                                        MD5

                                        6c33afa71cb021b3d90e5f31a46c1978

                                        SHA1

                                        2827f8753a4a63596f8cd1709718717eab2b6c2f

                                        SHA256

                                        838c0634bf6d430a4550df08f36af239d175dd9a2a2a817d0c6310b8e96402a8

                                        SHA512

                                        f7c5ab394a5175c0218b03c01cd974d57c895484880a8198c9ece72ff7b139f6e318e87d9befb5b11da6a417793fa09e5591be1ff2fff3990a8c0a4746f1e0ae

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57c1aa.TMP

                                        Filesize

                                        48B

                                        MD5

                                        d2ea4de2185f4b7ca06f8a1f207ab0ab

                                        SHA1

                                        712466069d3cfbf969f9685a55e755e552d7a6da

                                        SHA256

                                        f00e72c38ca258503ffdd91f8bdedcd8eb9cc57b88176fadc5a1b26f405b433b

                                        SHA512

                                        09d11712fa121b7b28dcb8a3aa7e8ef2b9a39b1e8864005c89b15d3932aebe129047d073fce5d70d033188a28264229a783aa11cacd0088141b345c1cf3859cf

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                        Filesize

                                        16B

                                        MD5

                                        6752a1d65b201c13b62ea44016eb221f

                                        SHA1

                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                        SHA256

                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                        SHA512

                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                        Filesize

                                        11KB

                                        MD5

                                        7c64dc399a176260b94a85de66c3d0fc

                                        SHA1

                                        22efecb70e40991b7d21f05d3fff69e62e8b4889

                                        SHA256

                                        c283e3af0ad40ab755ee67a9dc3fe22babeee999f92f7daceb4c4dee13c6b6a6

                                        SHA512

                                        3674174490929d3da0bf80b163a499e50d131d6c73a0961ba9a98ceea50894a630641f2ef385a9d40156469d93b0b809366b8bab169707801485e5cf9318e727

                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                        Filesize

                                        11KB

                                        MD5

                                        9a35ebe80791b42211273f025eb9c111

                                        SHA1

                                        77a1726759387283fe094d0b52c479ecfa3ee86a

                                        SHA256

                                        db1a02ffa6694ae5af3a917052de987b5a7ffdebea342b7709698347b79b7e3f

                                        SHA512

                                        12247ed3cb49a30eec2abbb9e413c53d97808c5bc4b54315fe5b95186c7048475c9189deb7b21bacad7dd98f84ff9b60e5cae6c884eaa50b62200d3cf2fe65ee

                                      • C:\Users\Admin\Downloads\Wave.exe

                                        Filesize

                                        78KB

                                        MD5

                                        e1f3dcf198b6f4d191a19b7f4dea728a

                                        SHA1

                                        7c8c094c18fa29ae748d7079b3b45e96f33c5eab

                                        SHA256

                                        e428b96c216e8e638a9ee6b53eacfb482a9d73f84bce33ac9e72e8d270c80fd2

                                        SHA512

                                        3e0c0e7f6349c7d233c62535a641c6d401680b9a688a23f3d12e257a56e346eb2831ef05e88dfd6c4e5581640c8ebeb1d58a740e84c8209135b2f034c3ddd608

                                      • memory/5184-205-0x000001C8F7990000-0x000001C8F79A8000-memory.dmp

                                        Filesize

                                        96KB

                                      • memory/5184-206-0x000001C8FA0E0000-0x000001C8FA2A2000-memory.dmp

                                        Filesize

                                        1.8MB

                                      • memory/5184-207-0x00007FF967350000-0x00007FF967E11000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/5184-208-0x000001C8F9730000-0x000001C8F9740000-memory.dmp

                                        Filesize

                                        64KB

                                      • memory/5184-209-0x000001C8FA8E0000-0x000001C8FAE08000-memory.dmp

                                        Filesize

                                        5.2MB

                                      • memory/5184-223-0x00007FF967350000-0x00007FF967E11000-memory.dmp

                                        Filesize

                                        10.8MB

                                      • memory/5676-220-0x00007FF967350000-0x00007FF967E11000-memory.dmp

                                        Filesize

                                        10.8MB