discordrat | hxxps://github[.]com/moom825/Discord-RAT-2[.]0/releases/tag/2[.]0

Resubmissions

16/02/2025, 01:02

250216-bdxqestqfs 8

16/02/2025, 01:00

250216-bcvjnstqbv 8

17/04/2024, 09:55

240417-lx5kgsda8x 6

Analysis

max time kernel
120s
max time network
124s
platform
windows11-21h2_x64
resource
win11-20250210-en
resource tags

arch:x64arch:x86image:win11-20250210-enlocale:en-usos:windows11-21h2-x64system
submitted
17/04/2024, 10:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/moom825/Discord-RAT-2.0/releases/tag/2.0

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
7''910eeif'bf,q;f
server_id
7'u'1''1'

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Downloads MZ/PE file 1 IoCs

flow	pid	Process
54	812	Process not Found

Executes dropped EXE 1 IoCs

pid	Process
2040	Client-built.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
576	MicrosoftEdgeUpdate.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3019359784-2457033987-1305470222-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\release.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3256	msedge.exe
3256	msedge.exe
432	msedge.exe
432	msedge.exe
4776	msedge.exe
4776	msedge.exe
3948	identity_helper.exe
3948	identity_helper.exe
1572	msedge.exe
1572	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2040	Client-built.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe
432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 4144	432	msedge.exe	84
PID 432 wrote to memory of 4144	432	msedge.exe	84
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 2172	432	msedge.exe	85
PID 432 wrote to memory of 3256	432	msedge.exe	86
PID 432 wrote to memory of 3256	432	msedge.exe	86
PID 432 wrote to memory of 3116	432	msedge.exe	87
PID 432 wrote to memory of 3116	432	msedge.exe	87
PID 432 wrote to memory of 3116	432	msedge.exe	87
PID 432 wrote to memory of 3116	432	msedge.exe	87
PID 432 wrote to memory of 3116	432	msedge.exe	87
PID 432 wrote to memory of 3116	432	msedge.exe	87
PID 432 wrote to memory of 3116	432	msedge.exe	87
PID 432 wrote to memory of 3116	432	msedge.exe	87
PID 432 wrote to memory of 3116	432	msedge.exe	87
PID 432 wrote to memory of 3116	432	msedge.exe	87
PID 432 wrote to memory of 3116	432	msedge.exe	87
PID 432 wrote to memory of 3116	432	msedge.exe	87
PID 432 wrote to memory of 3116	432	msedge.exe	87
PID 432 wrote to memory of 3116	432	msedge.exe	87
PID 432 wrote to memory of 3116	432	msedge.exe	87
PID 432 wrote to memory of 3116	432	msedge.exe	87
PID 432 wrote to memory of 3116	432	msedge.exe	87
PID 432 wrote to memory of 3116	432	msedge.exe	87
PID 432 wrote to memory of 3116	432	msedge.exe	87
PID 432 wrote to memory of 3116	432	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/moom825/Discord-RAT-2.0/releases/tag/2.0
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffed5fc3cb8,0x7ffed5fc3cc8,0x7ffed5fc3cd8
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,1907102476318864507,16777715318820619734,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1812 /prefetch:2
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1916,1907102476318864507,16777715318820619734,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1916,1907102476318864507,16777715318820619734,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,1907102476318864507,16777715318820619734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,1907102476318864507,16777715318820619734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1916,1907102476318864507,16777715318820619734,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,1907102476318864507,16777715318820619734,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1916,1907102476318864507,16777715318820619734,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,1907102476318864507,16777715318820619734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,1907102476318864507,16777715318820619734,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,1907102476318864507,16777715318820619734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,1907102476318864507,16777715318820619734,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,1907102476318864507,16777715318820619734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,1907102476318864507,16777715318820619734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1916,1907102476318864507,16777715318820619734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1916,1907102476318864507,16777715318820619734,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1916,1907102476318864507,16777715318820619734,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5256 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1548

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7M0M2ODEzMzUtNjdEMS00QjRBLUJCQkQtMDZBRjREQTVBRDk3fSIgdXNlcmlkPSJ7MzkxQjBEMDQtNTE1RC00MzQ1LUExNjQtRTY0QzIwNzVDRUU4fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MTgyNkRERTUtMjZCNC00MzFELTk4NUMtOUE2RTBFRThERjEwfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RSt4YkF6Nlk2c1UxMjg5YlM2cWw0VlJMYmtqZkJVR1RNSnNqckhyNDRpST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjUiIGluc3RhbGxkYXRldGltZT0iMTczOTE4NDA0OCIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzgzNjU1NTg2OTkzMDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ2NzE2NTUwNzUiLz48L2FwcD48L3JlcXVlc3Q-
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:576

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:648

C:\Users\Admin\Downloads\release\builder.exe
"C:\Users\Admin\Downloads\release\builder.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4664

C:\Users\Admin\Downloads\release\Client-built.exe
"C:\Users\Admin\Downloads\release\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bbf85b641863926ff0feaf438cb364e0

SHA1
bdfb012ab2ca252ac3a8dc25ad4c25c3b8e169ca

SHA256
0d5e724ba117831ced9b4ec199dd44efa1b13e2a5c84e057889a43bc40ef355c

SHA512
2b0c0680736b52fa5c6ceca4a02077857febbb32b0111446341697c6d717516f87891500165fb207bd2b1be22b33e83fded0460346eb7fafbdc8c1bb27edd4a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1a7b67a444d67148a33e9c75facb4b08

SHA1
e28ff46796ac1f168e9a5c37bbedc83c772aeacf

SHA256
0de4e2c824c51e9caad4947a4162847f1fdb272cfdd4ac0bbbae9fbbaebf005b

SHA512
ab1bc3728a1c1315d4a7ad473181b2d01470c47d6a8f16225f1fdc6a46735ba49a16a20afa42cf81ac1b447b78c20b9cf4c1a1ea77b4543ff942aa89d5194767

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
ee144c851bcaff39e7945c94ec5c6734

SHA1
061af6ab808b0da79d5654d2730d83fcb8703ccc

SHA256
827ed4896b9e6c0f7fc9f8a9cbda687aa4a4c1422b138feacce398913bbc032a

SHA512
ab3e409503490ca961ac84eabf7e42a1bbc3861bfbaf225b17419860190342c03cbca4f16b0fb4a314f5411bc3343f2beb30abfaaee33304a9951e705711adb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
7e94eef311a6778053e0f2c7316d4a4e

SHA1
c3c0bbc8c947db2654ac5857903a1733196a93e5

SHA256
430b64782d816e293bb7a8b12e49acd5366b5f3a6508429a05600269248601b5

SHA512
ca3a9c084e988e4bb968960e2480fa89c5a6c72f1d3810138695e243a3ae54b22e4041988c4de1f817a6cf8c289652e60c19671292c7a4d5c7939097b3a94b99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4345fb439f1e8897f4913ca450f873ad

SHA1
c102bde70859ceb7e4bd8ec9bedf372070732e24

SHA256
a80f22448d98384c72be2419f29c65c4bcd1ede9b873d429634fef8cad7c98e1

SHA512
1cbab51f254410f52d578294a1a4c174b6ee9bbe8568a7227659b38c42b2684a50cd289b6dbd5017604b0b86fb314d0c1a2f440226ef9eedd8860cec3a5da786

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
254eb5b8e7e94a3e251a1bd4ac726973

SHA1
9922d863b00cbd1f8a1633e6ca5d9ab1ddc744fd

SHA256
ca6d1e89695f08957e54242260cf68df60f73481451c316868e05f6182be33f7

SHA512
7ed5d0b35876ebf9d246a8b45a5929729dee59453ccfde98d09a4247673fd63ae65dbe33f6beb1d2fea2470ed58a3f150d1ddcd580a06a3aed3b154370462cf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1d75a09266543c504f02eec31a8da6b5

SHA1
b69af952f95193c1ed750e0fdb1ccd8ef563ec52

SHA256
7ff75cd48b0394b849a5d08292ca0ee6b560cb38f940af25b614167258eb853d

SHA512
9ae714e8cc866d3f0289596b98846dae24aab96b2ebcbc301d847618cc631c27a4ec4d864d9fddb4f625e6ea6af70314eb987b2499be41323e9edeacd718adb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
866B

MD5
21216fef755b018fd5563b1c5e0233d4

SHA1
607538927fe11fc16362c550cd31035a9d501151

SHA256
6068b69a29db50db96eabdd8171bee4e08c489c8bce29fbc66ab2f332d76f18c

SHA512
78bd1a184a24198f81ffb5784ee047a6542d65f9fda90d3d09b6c634bfbcef07d10ff09661d57730d8183eb5767b5d19fd83c677ba392f1cb8b3036f4f1d8055

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
701B

MD5
fb2dba87db1ead1a867c62b0f7dc872e

SHA1
6431d4984cc903750c59b2f3f57fce1f544c49f4

SHA256
708d4795dc8dc987e4bb649f478e8f853d9cea1de48f636866f0cbb4d63981e3

SHA512
99ba98025c1d93a21d89ed6cd3baf19e591820ec9dd2d53086eb0c0084f4f93faaa30d6bde40d050e11999f0eae88d276c540ad7bc0c3e2b6b5b684f741ec775

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580328.TMP

Filesize
539B

MD5
37b7bc5b9cd193257cad7e6f4e90276c

SHA1
390440cb3fe0b3d24dd30130cf14b162b43993d8

SHA256
43ca14528ee12ac2e4e9509065a6006b9dab35a51eac50cb117f5167074bd5cc

SHA512
f9fcbba01f1c16fcc296b30d3b018f2701135e0dbd5a9b940e044b54b776065334c44f12ad384145201492cad9ba623107756ea555dab0e0aab5f72df4a4f232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1c2247da475233fb54663eaafd1e1681

SHA1
d47599a2364885b18d27cbd84944a44bf8891d53

SHA256
d5d679d5e65723e449c7aa24d74007742b5789c88e888d2a8916fe25cd46db35

SHA512
197b3eb14fc426c1ffe5a6b0011681c4f21844f28d722b0b5decfd7736124745bb68c63f4a60c18afa67915ee43ccf9359155b3408bf341df40d039c95beaf51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
58e6600e3be2c85dc6222a2cc782eee4

SHA1
eb8e4d84d6764d6d95de9149b73488754329dfd7

SHA256
dd01276d454a0b9cbb1544c84a549179d730d5bf54e36b36e4ac4a58d5ae383e

SHA512
9b864af06359fff942ac437ef3deaddb60f7b2ab41df9367cb73d463919854a3785d53561efd844d55e16743974102aa27a4d75b23826ef5de7eb7ee1a4bd69e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ff1af06526a747e0602a19f0924d2ff8

SHA1
fde9b9827cbfd4d988580bf195df14a179155bdb

SHA256
b714ac0b253c64bb64522bce7784bb6ecb7b625159cd1e9ea98e55700bf1033e

SHA512
19ba48ecbe17ca811c0f4a30afd40c858575cbc3364504e3dda0ec7d3895d9bb10853297085dcebab8cd624ab895213de53a17e73343a8447a5bfab7ce3fc5b3

Download Submit
C:\Users\Admin\Downloads\release.zip

Filesize
445KB

MD5
06a4fcd5eb3a39d7f50a0709de9900db

SHA1
50d089e915f69313a5187569cda4e6dec2d55ca7

SHA256
c13a0cd7c2c2fd577703bff026b72ed81b51266afa047328c8ff1c4a4d965c97

SHA512
75e5f637fd3282d088b1c0c1efd0de8a128f681e4ac66d6303d205471fe68b4fbf0356a21d803aff2cca6def455abad8619fedc8c7d51e574640eda0df561f9b

Download Submit
C:\Users\Admin\Downloads\release.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\release\Client-built.exe

Filesize
78KB

MD5
01fed3e64767d7b5b1c1fb13f6defb7f

SHA1
5724d932b27ba083869c15c8158591158342a291

SHA256
f70ff77dd5c0168f28215c205dbf4f835df98438c4128ae0a7e709c7ea76078e

SHA512
948e598db4154b791475babcc70de3682db2bb9ec01f52c147fdf4d878d33cb4cb74f9e9c73c40d4630b628164cf14313dbaef4d418e96edc2a0cda50647a6a9

Download Submit
memory/2040-309-0x0000026C35CF0000-0x0000026C35D08000-memory.dmp

Filesize
96KB

Download
memory/2040-310-0x0000026C50350000-0x0000026C50512000-memory.dmp

Filesize
1.8MB

Download
memory/2040-311-0x0000026C50BA0000-0x0000026C510C8000-memory.dmp

Filesize
5.2MB

Download
memory/4664-258-0x0000000000510000-0x0000000000518000-memory.dmp

Filesize
32KB

Download
memory/4664-259-0x00000000055C0000-0x0000000005B66000-memory.dmp

Filesize
5.6MB

Download
memory/4664-260-0x0000000005010000-0x00000000050A2000-memory.dmp

Filesize
584KB

Download
memory/4664-261-0x0000000004FC0000-0x0000000004FCA000-memory.dmp

Filesize
40KB

Download
memory/4664-304-0x0000000007AE0000-0x0000000007C02000-memory.dmp

Filesize
1.1MB

Download