discordrat | ab216a4c330fce82b5bf0449d35fd2d7d9c89a47c0d80e2278d272a99f420687

Analysis

max time kernel
73s
max time network
89s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16-04-2024 19:31

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

bc2d2dd6fe16371f18c219fa523d5c93
SHA1

7d1e801321c72587a7d0aa49e4f43555e7758789
SHA256

ab216a4c330fce82b5bf0449d35fd2d7d9c89a47c0d80e2278d272a99f420687
SHA512

174bd64722e56bcf14f4b4610894c4b332932e34e1bdd7c2421a63644ee24f8c86a2a9902579a8baaf44c91e70db9092e21196fc28e1cc621d4c28df385876d3
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+pPIC:5Zv5PDwbjNrmAE+ZIC

Score

10^/10

discordrat persistence rat rootkit spyware stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTEwNjU4NzkwNTg0MzAxNTczMQ.Gy9GZf.nefUfqGXXz1F_0UeH8PUa3eemxkDVD-rvvZ3VI
server_id
1215373982082146314

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1140 created 604	1140	Client-built.exe	5

Downloads MZ/PE file
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
57	discord.com
59	raw.githubusercontent.com
32	discord.com
55	discord.com
58	discord.com
61	discord.com
60	raw.githubusercontent.com
63	raw.githubusercontent.com
67	discord.com
68	discord.com
16	discord.com
17	discord.com
56	discord.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1140 set thread context of 3084	1140	Client-built.exe	96

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1140	Client-built.exe
3084	dllhost.exe
3084	dllhost.exe
3084	dllhost.exe
3084	dllhost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1140	Client-built.exe
Token: SeDebugPrivilege	1140	Client-built.exe
Token: SeDebugPrivilege	3084	dllhost.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 3084	1140	Client-built.exe	96
PID 1140 wrote to memory of 3084	1140	Client-built.exe	96
PID 1140 wrote to memory of 3084	1140	Client-built.exe	96
PID 1140 wrote to memory of 3084	1140	Client-built.exe	96
PID 1140 wrote to memory of 3084	1140	Client-built.exe	96
PID 1140 wrote to memory of 3084	1140	Client-built.exe	96
PID 1140 wrote to memory of 3084	1140	Client-built.exe	96
PID 1140 wrote to memory of 3084	1140	Client-built.exe	96
PID 1140 wrote to memory of 3084	1140	Client-built.exe	96
PID 1140 wrote to memory of 3084	1140	Client-built.exe	96
PID 1140 wrote to memory of 3084	1140	Client-built.exe	96
PID 3084 wrote to memory of 604	3084	dllhost.exe	5
PID 3084 wrote to memory of 684	3084	dllhost.exe	7
PID 3084 wrote to memory of 960	3084	dllhost.exe	12
PID 684 wrote to memory of 2616	684	lsass.exe	46
PID 3084 wrote to memory of 384	3084	dllhost.exe	13
PID 3084 wrote to memory of 392	3084	dllhost.exe	14
PID 684 wrote to memory of 2616	684	lsass.exe	46
PID 3084 wrote to memory of 880	3084	dllhost.exe	15
PID 3084 wrote to memory of 1116	3084	dllhost.exe	17
PID 3084 wrote to memory of 1124	3084	dllhost.exe	18
PID 684 wrote to memory of 2496	684	lsass.exe	44
PID 684 wrote to memory of 2496	684	lsass.exe	44
PID 684 wrote to memory of 2496	684	lsass.exe	44
PID 684 wrote to memory of 2496	684	lsass.exe	44
PID 684 wrote to memory of 2496	684	lsass.exe	44
PID 684 wrote to memory of 2496	684	lsass.exe	44
PID 684 wrote to memory of 2496	684	lsass.exe	44
PID 684 wrote to memory of 2496	684	lsass.exe	44
PID 684 wrote to memory of 2496	684	lsass.exe	44
PID 684 wrote to memory of 2496	684	lsass.exe	44
PID 684 wrote to memory of 2496	684	lsass.exe	44
PID 3084 wrote to memory of 1132	3084	dllhost.exe	19
PID 3084 wrote to memory of 1164	3084	dllhost.exe	20
PID 3084 wrote to memory of 1224	3084	dllhost.exe	21
PID 3084 wrote to memory of 1292	3084	dllhost.exe	22
PID 3084 wrote to memory of 1352	3084	dllhost.exe	23
PID 3084 wrote to memory of 1412	3084	dllhost.exe	24
PID 684 wrote to memory of 2616	684	lsass.exe	46
PID 3084 wrote to memory of 1512	3084	dllhost.exe	25
PID 3084 wrote to memory of 1540	3084	dllhost.exe	26
PID 3084 wrote to memory of 1560	3084	dllhost.exe	27
PID 3084 wrote to memory of 1652	3084	dllhost.exe	28

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:604
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:384
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{a67c10e3-00a5-4f26-b2a7-a195b8844d17}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3084

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1116

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1124

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1412
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3956
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3952
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1540

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2496

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2616

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/384-30-0x000001DAD5230000-0x000001DAD525A000-memory.dmp

Filesize
168KB

Download
memory/384-34-0x00007FF84CEF0000-0x00007FF84CF00000-memory.dmp

Filesize
64KB

Download
memory/384-42-0x000001DAD5230000-0x000001DAD525A000-memory.dmp

Filesize
168KB

Download
memory/392-45-0x000002337FE00000-0x000002337FE2A000-memory.dmp

Filesize
168KB

Download
memory/392-39-0x000002337FE00000-0x000002337FE2A000-memory.dmp

Filesize
168KB

Download
memory/392-41-0x00007FF84CEF0000-0x00007FF84CF00000-memory.dmp

Filesize
64KB

Download
memory/604-22-0x000002AFDB9B0000-0x000002AFDB9DA000-memory.dmp

Filesize
168KB

Download
memory/604-77-0x000002AFDB9B0000-0x000002AFDB9DA000-memory.dmp

Filesize
168KB

Download
memory/604-25-0x00007FF88CF0D000-0x00007FF88CF0E000-memory.dmp

Filesize
4KB

Download
memory/604-27-0x00007FF88CF0F000-0x00007FF88CF10000-memory.dmp

Filesize
4KB

Download
memory/604-20-0x000002AFDB9B0000-0x000002AFDB9DA000-memory.dmp

Filesize
168KB

Download
memory/604-76-0x00007FF84CEF0000-0x00007FF84CF00000-memory.dmp

Filesize
64KB

Download
memory/604-18-0x000002AFDB980000-0x000002AFDB9A3000-memory.dmp

Filesize
140KB

Download
memory/684-32-0x00000214869D0000-0x00000214869FA000-memory.dmp

Filesize
168KB

Download
memory/684-36-0x00007FF88CF0D000-0x00007FF88CF0E000-memory.dmp

Filesize
4KB

Download
memory/684-21-0x00000214869D0000-0x00000214869FA000-memory.dmp

Filesize
168KB

Download
memory/684-24-0x00007FF84CEF0000-0x00007FF84CF00000-memory.dmp

Filesize
64KB

Download
memory/880-157-0x000001926EDC0000-0x000001926EDEA000-memory.dmp

Filesize
168KB

Download
memory/880-53-0x00007FF84CEF0000-0x00007FF84CF00000-memory.dmp

Filesize
64KB

Download
memory/880-49-0x000001926EDC0000-0x000001926EDEA000-memory.dmp

Filesize
168KB

Download
memory/960-33-0x00007FF84CEF0000-0x00007FF84CF00000-memory.dmp

Filesize
64KB

Download
memory/960-43-0x00007FF88CF0C000-0x00007FF88CF0D000-memory.dmp

Filesize
4KB

Download
memory/960-29-0x00000229561A0000-0x00000229561CA000-memory.dmp

Filesize
168KB

Download
memory/960-40-0x00000229561A0000-0x00000229561CA000-memory.dmp

Filesize
168KB

Download
memory/1116-52-0x000001CA2DD30000-0x000001CA2DD5A000-memory.dmp

Filesize
168KB

Download
memory/1116-54-0x00007FF84CEF0000-0x00007FF84CF00000-memory.dmp

Filesize
64KB

Download
memory/1116-127-0x000001CA2DD30000-0x000001CA2DD5A000-memory.dmp

Filesize
168KB

Download
memory/1124-128-0x0000022923AF0000-0x0000022923B1A000-memory.dmp

Filesize
168KB

Download
memory/1124-62-0x00007FF84CEF0000-0x00007FF84CF00000-memory.dmp

Filesize
64KB

Download
memory/1124-57-0x0000022923AF0000-0x0000022923B1A000-memory.dmp

Filesize
168KB

Download
memory/1132-131-0x0000019CBA740000-0x0000019CBA76A000-memory.dmp

Filesize
168KB

Download
memory/1132-65-0x00007FF84CEF0000-0x00007FF84CF00000-memory.dmp

Filesize
64KB

Download
memory/1132-63-0x0000019CBA740000-0x0000019CBA76A000-memory.dmp

Filesize
168KB

Download
memory/1140-2-0x00007FF86EE30000-0x00007FF86F8F1000-memory.dmp

Filesize
10.8MB

Download
memory/1140-8-0x00007FF88CE70000-0x00007FF88D065000-memory.dmp

Filesize
2.0MB

Download
memory/1140-7-0x000001DAE6070000-0x000001DAE60AE000-memory.dmp

Filesize
248KB

Download
memory/1140-6-0x000001DAE60B0000-0x000001DAE60C0000-memory.dmp

Filesize
64KB

Download
memory/1140-5-0x00007FF86EE30000-0x00007FF86F8F1000-memory.dmp

Filesize
10.8MB

Download
memory/1140-0-0x000001DACBAD0000-0x000001DACBAE8000-memory.dmp

Filesize
96KB

Download
memory/1140-9-0x00007FF88BC50000-0x00007FF88BD0E000-memory.dmp

Filesize
760KB

Download
memory/1140-4-0x000001DAE6900000-0x000001DAE6E28000-memory.dmp

Filesize
5.2MB

Download
memory/1140-58-0x000001DACD740000-0x000001DACD752000-memory.dmp

Filesize
72KB

Download
memory/1140-1-0x000001DAE6100000-0x000001DAE62C2000-memory.dmp

Filesize
1.8MB

Download
memory/1140-3-0x000001DAE60B0000-0x000001DAE60C0000-memory.dmp

Filesize
64KB

Download
memory/1140-68-0x000001DAE60E0000-0x000001DAE60FE000-memory.dmp

Filesize
120KB

Download
memory/1140-35-0x000001DAE67C0000-0x000001DAE6836000-memory.dmp

Filesize
472KB

Download
memory/1164-69-0x00000244F6310000-0x00000244F633A000-memory.dmp

Filesize
168KB

Download
memory/1164-70-0x00007FF84CEF0000-0x00007FF84CF00000-memory.dmp

Filesize
64KB

Download
memory/1224-73-0x00000213BD3A0000-0x00000213BD3CA000-memory.dmp

Filesize
168KB

Download
memory/1224-74-0x00007FF84CEF0000-0x00007FF84CF00000-memory.dmp

Filesize
64KB

Download
memory/1292-86-0x00007FF84CEF0000-0x00007FF84CF00000-memory.dmp

Filesize
64KB

Download
memory/1292-82-0x00000272E13C0000-0x00000272E13EA000-memory.dmp

Filesize
168KB

Download
memory/1352-88-0x00007FF84CEF0000-0x00007FF84CF00000-memory.dmp

Filesize
64KB

Download
memory/1352-85-0x00000271DE5C0000-0x00000271DE5EA000-memory.dmp

Filesize
168KB

Download
memory/1412-92-0x00000288D2A80000-0x00000288D2AAA000-memory.dmp

Filesize
168KB

Download
memory/1512-97-0x0000020259D30000-0x0000020259D5A000-memory.dmp

Filesize
168KB

Download
memory/1540-104-0x0000021FD9DB0000-0x0000021FD9DDA000-memory.dmp

Filesize
168KB

Download
memory/1560-107-0x000001F0F8B80000-0x000001F0F8BAA000-memory.dmp

Filesize
168KB

Download
memory/1652-132-0x000002994F100000-0x000002994F12A000-memory.dmp

Filesize
168KB

Download
memory/1700-119-0x0000022FEDBD0000-0x0000022FEDBFA000-memory.dmp

Filesize
168KB

Download
memory/1708-148-0x00000270FD290000-0x00000270FD2BA000-memory.dmp

Filesize
168KB

Download
memory/1776-152-0x000002011D000000-0x000002011D02A000-memory.dmp

Filesize
168KB

Download
memory/1832-163-0x00000235EE1B0000-0x00000235EE1DA000-memory.dmp

Filesize
168KB

Download
memory/1888-168-0x000002AE518E0000-0x000002AE5190A000-memory.dmp

Filesize
168KB

Download
memory/3084-16-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/3084-13-0x00007FF88CE70000-0x00007FF88D065000-memory.dmp

Filesize
2.0MB

Download
memory/3084-15-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/3084-14-0x00007FF88BC50000-0x00007FF88BD0E000-memory.dmp

Filesize
760KB

Download
memory/3084-11-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/3084-10-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/3084-12-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/3952-151-0x0000019511190000-0x00000195111BA000-memory.dmp

Filesize
168KB

Download
memory/3952-139-0x00007FF88CE70000-0x00007FF88D065000-memory.dmp

Filesize
2.0MB

Download
memory/3952-135-0x0000019511190000-0x00000195111BA000-memory.dmp

Filesize
168KB

Download
memory/3952-143-0x00007FF88CE70000-0x00007FF88D065000-memory.dmp

Filesize
2.0MB

Download
memory/3956-113-0x0000019F1E900000-0x0000019F1E92A000-memory.dmp

Filesize
168KB

Download
memory/3956-129-0x0000019F1E900000-0x0000019F1E92A000-memory.dmp

Filesize
168KB

Download
memory/3956-124-0x00007FF88CE70000-0x00007FF88D065000-memory.dmp

Filesize
2.0MB

Download