discordrat | 77c7b76fa1b6ccddf78e18c3bf326da4959ac429abfd6d2803a3a18d2f568a4e

Analysis

max time kernel
210s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 12:08

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

d33f63ad58ec035142f60e75d843d2c4
SHA1

dc313419c8093ad73dfedce91b6a8b3a0778f4f6
SHA256

77c7b76fa1b6ccddf78e18c3bf326da4959ac429abfd6d2803a3a18d2f568a4e
SHA512

c33db013ad726b43328b1f2caade05584d1932e4da72194766bf92abe2a847d78b7f03bedd915fc959b3f7c3ec7d88cc09625d8c11b4b2d2726189384510c3bb
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+VPIC:5Zv5PDwbjNrmAE+FIC

Score

10^/10

discordrat persistence rat rootkit spyware stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIyOTQwMTgyMTIyMzg0NTk2MQ.GNBkL2.fyH6QqmGNy52Fx0WNTo5XR7RLT2EQEAdGT-F68
server_id
1209983056593817710

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1532 created 616	1532	Client-built.exe	5

Downloads MZ/PE file
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 17 IoCs

Web Service

T1102

flow	ioc
72	raw.githubusercontent.com
71	discord.com
41	discord.com
45	discord.com
60	discord.com
66	discord.com
17	discord.com
69	raw.githubusercontent.com
70	discord.com
73	discord.com
16	discord.com
44	discord.com
48	discord.com
64	raw.githubusercontent.com
65	raw.githubusercontent.com
68	discord.com
32	discord.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1532 set thread context of 1904	1532	Client-built.exe	96

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1532	Client-built.exe
1904	dllhost.exe
1904	dllhost.exe
1904	dllhost.exe
1904	dllhost.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
868	Process not Found
2988	Process not Found
2404	Process not Found
5048	Process not Found
1192	Process not Found
2960	Process not Found
1768	Process not Found
996	Process not Found
4276	Process not Found
1932	Process not Found
2924	Process not Found
4696	Process not Found
1676	Process not Found
1460	Process not Found
2788	Process not Found
4396	Process not Found
4140	Process not Found
2096	Process not Found
3000	Process not Found
2880	Process not Found
1888	Process not Found
4720	Process not Found
1540	Process not Found
4244	Process not Found
628	Process not Found
4984	Process not Found
3096	Process not Found
400	Process not Found
884	Process not Found
4112	Process not Found
2396	Process not Found
3792	Process not Found
1344	Process not Found
2624	Process not Found
1144	Process not Found
5108	Process not Found
3192	Process not Found
4812	Process not Found
2764	Process not Found
2100	Process not Found
4856	Process not Found
3272	Process not Found
1508	Process not Found
3220	Process not Found
944	Process not Found
4400	Process not Found
3036	Process not Found
4560	Process not Found
4504	Process not Found
1816	Process not Found
1552	Process not Found
856	Process not Found
1384	Process not Found
1756	Process not Found
3440	Process not Found
4100	Process not Found
4516	Process not Found
1376	Process not Found
228	Process not Found
2180	Process not Found
2020	Process not Found
1520	Process not Found
4424	Process not Found
4520	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1532	Client-built.exe
Token: SeDebugPrivilege	1532	Client-built.exe
Token: SeDebugPrivilege	1904	dllhost.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 1904	1532	Client-built.exe	96
PID 1532 wrote to memory of 1904	1532	Client-built.exe	96
PID 1532 wrote to memory of 1904	1532	Client-built.exe	96
PID 1532 wrote to memory of 1904	1532	Client-built.exe	96
PID 1532 wrote to memory of 1904	1532	Client-built.exe	96
PID 1532 wrote to memory of 1904	1532	Client-built.exe	96
PID 1532 wrote to memory of 1904	1532	Client-built.exe	96
PID 1532 wrote to memory of 1904	1532	Client-built.exe	96
PID 1532 wrote to memory of 1904	1532	Client-built.exe	96
PID 1532 wrote to memory of 1904	1532	Client-built.exe	96
PID 1532 wrote to memory of 1904	1532	Client-built.exe	96
PID 1904 wrote to memory of 616	1904	dllhost.exe	5
PID 1904 wrote to memory of 668	1904	dllhost.exe	7
PID 1904 wrote to memory of 948	1904	dllhost.exe	12
PID 1904 wrote to memory of 64	1904	dllhost.exe	13
PID 668 wrote to memory of 2860	668	lsass.exe	50
PID 1904 wrote to memory of 736	1904	dllhost.exe	14
PID 668 wrote to memory of 2860	668	lsass.exe	50
PID 668 wrote to memory of 2860	668	lsass.exe	50
PID 1904 wrote to memory of 900	1904	dllhost.exe	15
PID 1904 wrote to memory of 1104	1904	dllhost.exe	17
PID 668 wrote to memory of 2860	668	lsass.exe	50
PID 668 wrote to memory of 2860	668	lsass.exe	50
PID 1904 wrote to memory of 1116	1904	dllhost.exe	18
PID 668 wrote to memory of 2860	668	lsass.exe	50
PID 1904 wrote to memory of 1124	1904	dllhost.exe	19
PID 1904 wrote to memory of 1176	1904	dllhost.exe	20
PID 1904 wrote to memory of 1268	1904	dllhost.exe	21
PID 1904 wrote to memory of 1324	1904	dllhost.exe	22
PID 1904 wrote to memory of 1352	1904	dllhost.exe	23
PID 1904 wrote to memory of 1388	1904	dllhost.exe	24
PID 668 wrote to memory of 2860	668	lsass.exe	50
PID 1388 wrote to memory of 1836	1388	svchost.exe	104
PID 1388 wrote to memory of 1836	1388	svchost.exe	104
PID 1388 wrote to memory of 4728	1388	svchost.exe	106
PID 1388 wrote to memory of 4728	1388	svchost.exe	106

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:64
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{d571ed89-8134-44b4-88e4-4fdfacf48a86}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1904

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:736

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1116

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1124

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:1836
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:4728

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2860

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/64-32-0x000002881B270000-0x000002881B29A000-memory.dmp

Filesize
168KB

Download
memory/64-44-0x00007FFA473AC000-0x00007FFA473AD000-memory.dmp

Filesize
4KB

Download
memory/64-42-0x00007FFA473AF000-0x00007FFA473B0000-memory.dmp

Filesize
4KB

Download
memory/64-81-0x00007FFA07390000-0x00007FFA073A0000-memory.dmp

Filesize
64KB

Download
memory/64-82-0x000002881B270000-0x000002881B29A000-memory.dmp

Filesize
168KB

Download
memory/64-39-0x000002881B270000-0x000002881B29A000-memory.dmp

Filesize
168KB

Download
memory/616-20-0x00000190FC650000-0x00000190FC673000-memory.dmp

Filesize
140KB

Download
memory/616-27-0x00007FFA473AD000-0x00007FFA473AE000-memory.dmp

Filesize
4KB

Download
memory/616-22-0x00000190FCA30000-0x00000190FCA5A000-memory.dmp

Filesize
168KB

Download
memory/616-23-0x00000190FCA30000-0x00000190FCA5A000-memory.dmp

Filesize
168KB

Download
memory/668-30-0x000002660C630000-0x000002660C65A000-memory.dmp

Filesize
168KB

Download
memory/668-34-0x00007FFA473AD000-0x00007FFA473AE000-memory.dmp

Filesize
4KB

Download
memory/668-26-0x00007FFA07390000-0x00007FFA073A0000-memory.dmp

Filesize
64KB

Download
memory/668-24-0x000002660C630000-0x000002660C65A000-memory.dmp

Filesize
168KB

Download
memory/736-38-0x000001D3E0860000-0x000001D3E088A000-memory.dmp

Filesize
168KB

Download
memory/736-41-0x00007FFA07390000-0x00007FFA073A0000-memory.dmp

Filesize
64KB

Download
memory/736-45-0x000001D3E0860000-0x000001D3E088A000-memory.dmp

Filesize
168KB

Download
memory/900-48-0x0000023264760000-0x000002326478A000-memory.dmp

Filesize
168KB

Download
memory/900-99-0x0000023264760000-0x000002326478A000-memory.dmp

Filesize
168KB

Download
memory/900-50-0x0000023264760000-0x000002326478A000-memory.dmp

Filesize
168KB

Download
memory/900-49-0x00007FFA07390000-0x00007FFA073A0000-memory.dmp

Filesize
64KB

Download
memory/948-31-0x0000027D5A3A0000-0x0000027D5A3CA000-memory.dmp

Filesize
168KB

Download
memory/948-35-0x00007FFA07390000-0x00007FFA073A0000-memory.dmp

Filesize
64KB

Download
memory/948-40-0x00007FFA473AC000-0x00007FFA473AD000-memory.dmp

Filesize
4KB

Download
memory/948-84-0x0000027D5A3A0000-0x0000027D5A3CA000-memory.dmp

Filesize
168KB

Download
memory/948-36-0x0000027D5A3A0000-0x0000027D5A3CA000-memory.dmp

Filesize
168KB

Download
memory/1104-100-0x0000016D13060000-0x0000016D1308A000-memory.dmp

Filesize
168KB

Download
memory/1104-55-0x00007FFA07390000-0x00007FFA073A0000-memory.dmp

Filesize
64KB

Download
memory/1104-54-0x0000016D13060000-0x0000016D1308A000-memory.dmp

Filesize
168KB

Download
memory/1116-59-0x00007FFA07390000-0x00007FFA073A0000-memory.dmp

Filesize
64KB

Download
memory/1116-57-0x000002692AA60000-0x000002692AA8A000-memory.dmp

Filesize
168KB

Download
memory/1116-101-0x000002692AA60000-0x000002692AA8A000-memory.dmp

Filesize
168KB

Download
memory/1124-64-0x000001CEBB900000-0x000001CEBB92A000-memory.dmp

Filesize
168KB

Download
memory/1124-66-0x00007FFA07390000-0x00007FFA073A0000-memory.dmp

Filesize
64KB

Download
memory/1124-103-0x000001CEBB900000-0x000001CEBB92A000-memory.dmp

Filesize
168KB

Download
memory/1176-65-0x0000021CDB200000-0x0000021CDB22A000-memory.dmp

Filesize
168KB

Download
memory/1176-67-0x00007FFA07390000-0x00007FFA073A0000-memory.dmp

Filesize
64KB

Download
memory/1176-104-0x0000021CDB200000-0x0000021CDB22A000-memory.dmp

Filesize
168KB

Download
memory/1268-73-0x00007FFA07390000-0x00007FFA073A0000-memory.dmp

Filesize
64KB

Download
memory/1268-72-0x0000022BB57A0000-0x0000022BB57CA000-memory.dmp

Filesize
168KB

Download
memory/1268-106-0x0000022BB57A0000-0x0000022BB57CA000-memory.dmp

Filesize
168KB

Download
memory/1324-105-0x0000026A25F80000-0x0000026A25FAA000-memory.dmp

Filesize
168KB

Download
memory/1324-83-0x00007FFA07390000-0x00007FFA073A0000-memory.dmp

Filesize
64KB

Download
memory/1324-78-0x0000026A25F80000-0x0000026A25FAA000-memory.dmp

Filesize
168KB

Download
memory/1352-91-0x00000189AFFC0000-0x00000189AFFEA000-memory.dmp

Filesize
168KB

Download
memory/1352-107-0x00000189AFFC0000-0x00000189AFFEA000-memory.dmp

Filesize
168KB

Download
memory/1388-94-0x0000018DB3D10000-0x0000018DB3D3A000-memory.dmp

Filesize
168KB

Download
memory/1388-108-0x0000018DB3D10000-0x0000018DB3D3A000-memory.dmp

Filesize
168KB

Download
memory/1532-6-0x00000291A4DF0000-0x00000291A4E00000-memory.dmp

Filesize
64KB

Download
memory/1532-3-0x00000291A4DF0000-0x00000291A4E00000-memory.dmp

Filesize
64KB

Download
memory/1532-0-0x000002918A7E0000-0x000002918A7F8000-memory.dmp

Filesize
96KB

Download
memory/1532-11-0x00007FFA45510000-0x00007FFA455CE000-memory.dmp

Filesize
760KB

Download
memory/1532-8-0x000002918C5B0000-0x000002918C5BE000-memory.dmp

Filesize
56KB

Download
memory/1532-10-0x00007FFA47310000-0x00007FFA47505000-memory.dmp

Filesize
2.0MB

Download
memory/1532-7-0x00000291A8940000-0x00000291A8C0A000-memory.dmp

Filesize
2.8MB

Download
memory/1532-1-0x00000291A4EC0000-0x00000291A5082000-memory.dmp

Filesize
1.8MB

Download
memory/1532-95-0x00007FFA29330000-0x00007FFA29DF1000-memory.dmp

Filesize
10.8MB

Download
memory/1532-9-0x000002918C5D0000-0x000002918C60E000-memory.dmp

Filesize
248KB

Download
memory/1532-5-0x00007FFA29330000-0x00007FFA29DF1000-memory.dmp

Filesize
10.8MB

Download
memory/1532-4-0x00000291A5700000-0x00000291A5C28000-memory.dmp

Filesize
5.2MB

Download
memory/1532-2-0x00007FFA29330000-0x00007FFA29DF1000-memory.dmp

Filesize
10.8MB

Download
memory/1904-15-0x00007FFA47310000-0x00007FFA47505000-memory.dmp

Filesize
2.0MB

Download
memory/1904-18-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/1904-14-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/1904-17-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/1904-12-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/1904-16-0x00007FFA45510000-0x00007FFA455CE000-memory.dmp

Filesize
760KB

Download
memory/1904-13-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download