Resubmissions

01-05-2024 15:23

240501-ssgfesca99 1

22-04-2024 08:54

240422-kvcw1shf99 10

22-04-2024 08:50

240422-krk38ahf67 10

Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-04-2024 08:54

General

  • Target

    https://filetransfer.io/data-package/g83ORAG3#link

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTIzMDgwNjQ0NzM2NTk0NzQ1Ng.G2vGiE.8f97-UjGmmPjSih2nipyB83KB174hMORkyul_0

  • server_id

    1229126898051973120

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 38 IoCs
  • Suspicious use of SendNotifyMessage 38 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://filetransfer.io/data-package/g83ORAG3#link
    1⤵
      PID:2548
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=3784 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:1
      1⤵
        PID:1488
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=4724 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:1
        1⤵
          PID:3640
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5804 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
          1⤵
            PID:660
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=5484 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:1
            1⤵
              PID:5040
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3808 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
              1⤵
                PID:4328
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --mojo-platform-channel-handle=3820 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
                1⤵
                  PID:2316
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --mojo-platform-channel-handle=3784 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:1
                  1⤵
                    PID:2744
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6172 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
                    1⤵
                      PID:4880
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --mojo-platform-channel-handle=6348 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
                      1⤵
                        PID:5064
                      • C:\Windows\System32\rundll32.exe
                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                        1⤵
                          PID:1688
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=6364 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
                          1⤵
                            PID:3288
                          • C:\Users\Admin\Downloads\& .exe
                            "C:\Users\Admin\Downloads\& .exe"
                            1⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4092
                          • C:\Users\Admin\Downloads\& .exe
                            "C:\Users\Admin\Downloads\& .exe"
                            1⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4552
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=6476 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
                            1⤵
                              PID:4296
                            • C:\Users\Admin\Downloads\& .exe
                              "C:\Users\Admin\Downloads\& .exe"
                              1⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4176
                            • C:\Users\Admin\Downloads\& .exe
                              "C:\Users\Admin\Downloads\& .exe"
                              1⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1964
                            • C:\Users\Admin\Downloads\& .exe
                              "C:\Users\Admin\Downloads\& .exe"
                              1⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:512
                            • C:\Users\Admin\Downloads\& .exe
                              "C:\Users\Admin\Downloads\& .exe"
                              1⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4720
                            • C:\Users\Admin\Downloads\& .exe
                              "C:\Users\Admin\Downloads\& .exe"
                              1⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:5240
                            • C:\Users\Admin\Downloads\& .exe
                              "C:\Users\Admin\Downloads\& .exe"
                              1⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:5248
                            • C:\Users\Admin\Downloads\& .exe
                              "C:\Users\Admin\Downloads\& .exe"
                              1⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:5288
                            • C:\Windows\system32\taskmgr.exe
                              "C:\Windows\system32\taskmgr.exe" /4
                              1⤵
                              • Checks SCSI registry key(s)
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              PID:5584
                            • C:\Users\Admin\Downloads\& .exe
                              "C:\Users\Admin\Downloads\& .exe"
                              1⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:6132

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • memory/512-42-0x00007FF985560000-0x00007FF986021000-memory.dmp

                              Filesize

                              10.8MB

                            • memory/512-13-0x00007FF985560000-0x00007FF986021000-memory.dmp

                              Filesize

                              10.8MB

                            • memory/512-16-0x000002291C730000-0x000002291C740000-memory.dmp

                              Filesize

                              64KB

                            • memory/512-45-0x000002291C730000-0x000002291C740000-memory.dmp

                              Filesize

                              64KB

                            • memory/1964-12-0x000001C8D82C0000-0x000001C8D82D0000-memory.dmp

                              Filesize

                              64KB

                            • memory/1964-11-0x00007FF985560000-0x00007FF986021000-memory.dmp

                              Filesize

                              10.8MB

                            • memory/1964-40-0x00007FF985560000-0x00007FF986021000-memory.dmp

                              Filesize

                              10.8MB

                            • memory/1964-41-0x000001C8D82C0000-0x000001C8D82D0000-memory.dmp

                              Filesize

                              64KB

                            • memory/4092-3-0x000001A5E4AD0000-0x000001A5E4AE0000-memory.dmp

                              Filesize

                              64KB

                            • memory/4092-6-0x000001A5E4AD0000-0x000001A5E4AE0000-memory.dmp

                              Filesize

                              64KB

                            • memory/4092-5-0x00007FF985560000-0x00007FF986021000-memory.dmp

                              Filesize

                              10.8MB

                            • memory/4092-4-0x000001A5FE860000-0x000001A5FED88000-memory.dmp

                              Filesize

                              5.2MB

                            • memory/4092-2-0x00007FF985560000-0x00007FF986021000-memory.dmp

                              Filesize

                              10.8MB

                            • memory/4092-1-0x000001A5FD3E0000-0x000001A5FD5A2000-memory.dmp

                              Filesize

                              1.8MB

                            • memory/4092-0-0x000001A5E2D80000-0x000001A5E2D98000-memory.dmp

                              Filesize

                              96KB

                            • memory/4176-38-0x00007FF985560000-0x00007FF986021000-memory.dmp

                              Filesize

                              10.8MB

                            • memory/4176-9-0x00007FF985560000-0x00007FF986021000-memory.dmp

                              Filesize

                              10.8MB

                            • memory/4176-10-0x000002ABAAAB0000-0x000002ABAAAC0000-memory.dmp

                              Filesize

                              64KB

                            • memory/4176-39-0x000002ABAAAB0000-0x000002ABAAAC0000-memory.dmp

                              Filesize

                              64KB

                            • memory/4552-7-0x00007FF985560000-0x00007FF986021000-memory.dmp

                              Filesize

                              10.8MB

                            • memory/4552-8-0x000001CC7F5A0000-0x000001CC7F5B0000-memory.dmp

                              Filesize

                              64KB

                            • memory/4552-21-0x00007FF985560000-0x00007FF986021000-memory.dmp

                              Filesize

                              10.8MB

                            • memory/4552-37-0x000001CC7F5A0000-0x000001CC7F5B0000-memory.dmp

                              Filesize

                              64KB

                            • memory/4720-43-0x00007FF985560000-0x00007FF986021000-memory.dmp

                              Filesize

                              10.8MB

                            • memory/4720-15-0x0000020E9AFD0000-0x0000020E9AFE0000-memory.dmp

                              Filesize

                              64KB

                            • memory/4720-14-0x00007FF985560000-0x00007FF986021000-memory.dmp

                              Filesize

                              10.8MB

                            • memory/5240-18-0x00007FF985560000-0x00007FF986021000-memory.dmp

                              Filesize

                              10.8MB

                            • memory/5240-48-0x00007FF985560000-0x00007FF986021000-memory.dmp

                              Filesize

                              10.8MB

                            • memory/5240-49-0x0000022009F00000-0x0000022009F10000-memory.dmp

                              Filesize

                              64KB

                            • memory/5240-19-0x0000022009F00000-0x0000022009F10000-memory.dmp

                              Filesize

                              64KB

                            • memory/5248-46-0x00007FF985560000-0x00007FF986021000-memory.dmp

                              Filesize

                              10.8MB

                            • memory/5248-22-0x000001FEC4A60000-0x000001FEC4A70000-memory.dmp

                              Filesize

                              64KB

                            • memory/5248-51-0x000001FEC4A60000-0x000001FEC4A70000-memory.dmp

                              Filesize

                              64KB

                            • memory/5248-17-0x00007FF985560000-0x00007FF986021000-memory.dmp

                              Filesize

                              10.8MB

                            • memory/5288-20-0x00000189908D0000-0x00000189908E0000-memory.dmp

                              Filesize

                              64KB

                            • memory/5288-50-0x00000189908D0000-0x00000189908E0000-memory.dmp

                              Filesize

                              64KB

                            • memory/5288-23-0x00007FF985560000-0x00007FF986021000-memory.dmp

                              Filesize

                              10.8MB

                            • memory/5288-52-0x00007FF985560000-0x00007FF986021000-memory.dmp

                              Filesize

                              10.8MB

                            • memory/5584-24-0x000002045E950000-0x000002045E951000-memory.dmp

                              Filesize

                              4KB

                            • memory/5584-36-0x000002045E950000-0x000002045E951000-memory.dmp

                              Filesize

                              4KB

                            • memory/5584-35-0x000002045E950000-0x000002045E951000-memory.dmp

                              Filesize

                              4KB

                            • memory/5584-34-0x000002045E950000-0x000002045E951000-memory.dmp

                              Filesize

                              4KB

                            • memory/5584-33-0x000002045E950000-0x000002045E951000-memory.dmp

                              Filesize

                              4KB

                            • memory/5584-32-0x000002045E950000-0x000002045E951000-memory.dmp

                              Filesize

                              4KB

                            • memory/5584-31-0x000002045E950000-0x000002045E951000-memory.dmp

                              Filesize

                              4KB

                            • memory/5584-30-0x000002045E950000-0x000002045E951000-memory.dmp

                              Filesize

                              4KB

                            • memory/5584-25-0x000002045E950000-0x000002045E951000-memory.dmp

                              Filesize

                              4KB

                            • memory/5584-26-0x000002045E950000-0x000002045E951000-memory.dmp

                              Filesize

                              4KB

                            • memory/6132-44-0x00007FF985560000-0x00007FF986021000-memory.dmp

                              Filesize

                              10.8MB

                            • memory/6132-47-0x000001EF86610000-0x000001EF86620000-memory.dmp

                              Filesize

                              64KB

                            • memory/6132-53-0x00007FF985560000-0x00007FF986021000-memory.dmp

                              Filesize

                              10.8MB