discordrat | 398c45daf283a0bb0a57696cac3c2f67fff96d5ea5f0f53a6f1dd7a693a0e22a

Resubmissions

16-04-2024 10:41

240416-mrjaqsab9w 3

15-04-2024 18:03

240415-wnfj4sfa2v 6

15-04-2024 17:57

240415-wj2xjsce98 10

15-04-2024 17:53

240415-wgfljaeg6s 10

Analysis

max time kernel
49s
max time network
50s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 17:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MainMenu.rbxm
Size

14KB
MD5

570b9b9cd36ee573826296c9c1e24dea
SHA1

69bb3c2b05b2043b53fa2fa25f3c227d3b3c7bbc
SHA256

398c45daf283a0bb0a57696cac3c2f67fff96d5ea5f0f53a6f1dd7a693a0e22a
SHA512

6d59a8fed062a7a95ddeab579e21f2eda37c9c9a635be657bd1122fb57498f20a18deb9fa3434c4d9dad62bf85a1a9a1751e5e21a7a0403863039edd51a39a82
SSDEEP

192:WkV5Yqitq3KfkjaGRCNkjWKARcZizO9Bpy/nw8vJemQQJ:pDaiLRCJKocZiy9Py/nLvJeyJ

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIyMjY1ODg0NzM1NzkyNzQzNQ.G46owp.2JEzFsoF0sNveJ3Ig7Q_yTdVD59ktO7ZBNMdzw
server_id
1211370597838487562

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Executes dropped EXE 1 IoCs

pid	Process
5132	FunnyDoxTool.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
88	discord.com
89	discord.com
95	discord.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\FunnyDoxTool.exe:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4708	firefox.exe
Token: SeDebugPrivilege	4708	firefox.exe
Token: SeDebugPrivilege	5132	FunnyDoxTool.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4708	firefox.exe
4708	firefox.exe
4708	firefox.exe
4708	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4708	firefox.exe
4708	firefox.exe
4708	firefox.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3960	OpenWith.exe
4708	firefox.exe
4708	firefox.exe
4708	firefox.exe
4708	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 4708	3928	firefox.exe	94
PID 3928 wrote to memory of 4708	3928	firefox.exe	94
PID 3928 wrote to memory of 4708	3928	firefox.exe	94
PID 3928 wrote to memory of 4708	3928	firefox.exe	94
PID 3928 wrote to memory of 4708	3928	firefox.exe	94
PID 3928 wrote to memory of 4708	3928	firefox.exe	94
PID 3928 wrote to memory of 4708	3928	firefox.exe	94
PID 3928 wrote to memory of 4708	3928	firefox.exe	94
PID 3928 wrote to memory of 4708	3928	firefox.exe	94
PID 3928 wrote to memory of 4708	3928	firefox.exe	94
PID 3928 wrote to memory of 4708	3928	firefox.exe	94
PID 4708 wrote to memory of 2224	4708	firefox.exe	95
PID 4708 wrote to memory of 2224	4708	firefox.exe	95
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 2676	4708	firefox.exe	96
PID 4708 wrote to memory of 4852	4708	firefox.exe	97
PID 4708 wrote to memory of 4852	4708	firefox.exe	97
PID 4708 wrote to memory of 4852	4708	firefox.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MainMenu.rbxm
1⤵
- Modifies registry class
PID:3192

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3960

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4708.0.1112656540\1292596843" -parentBuildID 20221007134813 -prefsHandle 1800 -prefMapHandle 1796 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7dba6850-55e7-4dd8-a2e4-95984507dd09} 4708 "\\.\pipe\gecko-crash-server-pipe.4708" 1964 1d82f7d7e58 gpu
    3⤵
    PID:2224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4708.1.1878204917\333203703" -parentBuildID 20221007134813 -prefsHandle 2336 -prefMapHandle 2332 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f086b29a-d5cc-41f6-bdce-9a28a59b2794} 4708 "\\.\pipe\gecko-crash-server-pipe.4708" 2364 1d82f4fd258 socket
    3⤵
    PID:2676
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4708.2.1864992970\1152001785" -childID 1 -isForBrowser -prefsHandle 3180 -prefMapHandle 3176 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1384 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {de6d0ba3-1b79-45c3-bea9-a9bdf79a1f41} 4708 "\\.\pipe\gecko-crash-server-pipe.4708" 3192 1d82f75fc58 tab
    3⤵
    PID:4852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4708.3.1507651361\76900345" -childID 2 -isForBrowser -prefsHandle 3580 -prefMapHandle 3576 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1384 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2bc33636-208e-48e2-84be-5361c0a294f3} 4708 "\\.\pipe\gecko-crash-server-pipe.4708" 3560 1d831ec5558 tab
    3⤵
    PID:372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4708.4.609373687\1596989693" -childID 3 -isForBrowser -prefsHandle 3852 -prefMapHandle 3848 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1384 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {523d5e66-cb08-4957-98f5-2e87cb485ad4} 4708 "\\.\pipe\gecko-crash-server-pipe.4708" 3860 1d832210258 tab
    3⤵
    PID:4284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4708.5.1061289369\1989049075" -childID 4 -isForBrowser -prefsHandle 2840 -prefMapHandle 2836 -prefsLen 26285 -prefMapSize 233444 -jsInitHandle 1384 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {34ccba0d-4755-4236-bbf0-88c4987cdc3c} 4708 "\\.\pipe\gecko-crash-server-pipe.4708" 4896 1d81ba5f858 tab
    3⤵
    PID:5168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4708.6.2139700390\1010091529" -childID 5 -isForBrowser -prefsHandle 4912 -prefMapHandle 4908 -prefsLen 26285 -prefMapSize 233444 -jsInitHandle 1384 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ebea6162-0795-45a2-88ed-a3ea59ffdd24} 4708 "\\.\pipe\gecko-crash-server-pipe.4708" 5052 1d835c27158 tab
    3⤵
    PID:5176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4708.7.700898513\48033796" -childID 6 -isForBrowser -prefsHandle 5060 -prefMapHandle 3792 -prefsLen 26285 -prefMapSize 233444 -jsInitHandle 1384 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eba99e19-9aa3-4465-9bf4-72e57a7f114c} 4708 "\\.\pipe\gecko-crash-server-pipe.4708" 5076 1d8354ca058 tab
    3⤵
    PID:5184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4708.8.1455826871\1649245467" -childID 7 -isForBrowser -prefsHandle 5948 -prefMapHandle 5944 -prefsLen 26285 -prefMapSize 233444 -jsInitHandle 1384 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {58fe8b60-fa50-41ce-a920-fff448f805e9} 4708 "\\.\pipe\gecko-crash-server-pipe.4708" 5932 1d83665e458 tab
    3⤵
    PID:5908
- - C:\Users\Admin\Downloads\FunnyDoxTool.exe
    "C:\Users\Admin\Downloads\FunnyDoxTool.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3760 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:4612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control