Analysis

  • max time kernel
    75s
  • max time network
    77s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-04-2024 11:50

Errors

Reason
Machine shutdown: "{\"level\":\"info\",\"time\":\"2024-04-23T11:52:15Z\",\"message\":\"Dirty snapshot: /var/lib/sandbox/hatchvm/win10v2004-20240412-en/instance_4-dirty.qcow2\"}"

General

  • Target

    https://github.com/moom825/Discord-RAT-2.0/releases/download/2.0/release.zip

Malware Config

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/moom825/Discord-RAT-2.0/releases/download/2.0/release.zip
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4012
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd03446f8,0x7ffdd0344708,0x7ffdd0344718
      2⤵
        PID:3100
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,3401976018341541855,594984327123173893,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2292 /prefetch:2
        2⤵
          PID:3364
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,3401976018341541855,594984327123173893,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4836
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,3401976018341541855,594984327123173893,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
          2⤵
            PID:1320
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,3401976018341541855,594984327123173893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
            2⤵
              PID:3912
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,3401976018341541855,594984327123173893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
              2⤵
                PID:3980
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,3401976018341541855,594984327123173893,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
                2⤵
                  PID:3932
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,3401976018341541855,594984327123173893,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4428
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2212,3401976018341541855,594984327123173893,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4216 /prefetch:8
                  2⤵
                    PID:3156
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,3401976018341541855,594984327123173893,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4476 /prefetch:1
                    2⤵
                      PID:428
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2212,3401976018341541855,594984327123173893,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4476
                  • C:\Windows\System32\CompPkgSrv.exe
                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                    1⤵
                      PID:1016
                    • C:\Windows\System32\CompPkgSrv.exe
                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                      1⤵
                        PID:3716
                      • C:\Windows\System32\rundll32.exe
                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                        1⤵
                          PID:5296
                        • C:\Users\Admin\AppData\Local\Temp\Temp1_release.zip\builder.exe
                          "C:\Users\Admin\AppData\Local\Temp\Temp1_release.zip\builder.exe"
                          1⤵
                            PID:5684
                          • C:\Users\Admin\AppData\Local\Temp\Temp1_release.zip\Release\Discord rat.exe
                            "C:\Users\Admin\AppData\Local\Temp\Temp1_release.zip\Release\Discord rat.exe"
                            1⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4520
                          • C:\Windows\system32\OpenWith.exe
                            C:\Windows\system32\OpenWith.exe -Embedding
                            1⤵
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:5068
                          • C:\Users\Admin\AppData\Local\Temp\Temp2_release.zip\builder.exe
                            "C:\Users\Admin\AppData\Local\Temp\Temp2_release.zip\builder.exe"
                            1⤵
                              PID:460
                            • C:\Windows\system32\LogonUI.exe
                              "LogonUI.exe" /flags:0x4 /state0:0xa3928855 /state1:0x41c64e6d
                              1⤵
                              • Modifies data under HKEY_USERS
                              • Suspicious use of SetWindowsHookEx
                              PID:2832

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              120a75f233314ba1fe34e9d6c09f30b9

                              SHA1

                              a9f92f2d3f111eaadd9bcf8fceb3c9553753539c

                              SHA256

                              e04101215c3534dbc77c0b5df2e1d1ff74c277d2946f391f939c9a7948a22dd0

                              SHA512

                              3c4eb93e425b50e8bcc1712f4cc2be11888a0273c3a619fc6bf72ccab876a427158f661bfc80d0c1e47ef4116febf76a3aaa31a60ec662eae0e51c7f1d3d89b3

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                              Filesize

                              152B

                              MD5

                              bc2edd0741d97ae237e9f00bf3244144

                              SHA1

                              7c1e5d324f5c7137a3c4ec85146659f026c11782

                              SHA256

                              dbce3287c7ae69ccbd1d780c39f3ffa3c98bd4609a939fff8ee9c99f14265041

                              SHA512

                              00f505a0b4ea0df626175bf9d39a205f18f9754b62e4dba6fbb5b4a716b3539e7809723e1596bcfe1ba3041e22342e3a9cbaad88e84ce9c8c6531331bbc25093

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              42936b11e1a98d5f9a982894f85fade1

                              SHA1

                              eff3a54edb226d3de5fd56419015405528078b71

                              SHA256

                              513d15f56436112d2ff5580295165ffe055b0b40be6e6a3dc2b62a2f44d8527b

                              SHA512

                              fab9b35905020f87de34a1d1579c55084d01375be56b9811d3bf985fc0a8df69bc324779282dd98a715e90500c09076a5214eb0a58c392341be4a3979b9c6836

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              74d9e7a78790582f51bc64dad323b715

                              SHA1

                              b8cc1a8357e6b7fe14dbabfa50be6157d4f25485

                              SHA256

                              621461e8ba6c931f8b9b5b8793f6cd521c243a6ff277d14f060b511e46a4e3dc

                              SHA512

                              d2dee41d0180c869169dd86ae0946ba0f08aa07b1198f829cd6cc4258bcbaa48efb0f35255e30bc59c95736c363c0935f8538bc3ac12dda3f4de2e6ab5034c8b

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                              Filesize

                              16B

                              MD5

                              6752a1d65b201c13b62ea44016eb221f

                              SHA1

                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                              SHA256

                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                              SHA512

                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                              Filesize

                              11KB

                              MD5

                              e1aff8af2ea09ffe951adcec9548f7a5

                              SHA1

                              b6b1a329373a19fffd17e5292c113b86b489e8b3

                              SHA256

                              4ab586ede9f95629ecad4f25c23b14eefd47b66ddb1270eea9ae438642a2bb08

                              SHA512

                              798c4461384b6831306013eb2fbd1e0528c746cf4ee82197f2efe3cd5a2e8f24b377ba7a597dcd027e5d41405f4e4140ca2714e666a6b707a42202e99fce1e45

                            • C:\Users\Admin\Downloads\release.zip

                              Filesize

                              445KB

                              MD5

                              06a4fcd5eb3a39d7f50a0709de9900db

                              SHA1

                              50d089e915f69313a5187569cda4e6dec2d55ca7

                              SHA256

                              c13a0cd7c2c2fd577703bff026b72ed81b51266afa047328c8ff1c4a4d965c97

                              SHA512

                              75e5f637fd3282d088b1c0c1efd0de8a128f681e4ac66d6303d205471fe68b4fbf0356a21d803aff2cca6def455abad8619fedc8c7d51e574640eda0df561f9b

                            • memory/460-125-0x0000000074DC0000-0x0000000075570000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/460-100-0x0000000004D70000-0x0000000004D80000-memory.dmp

                              Filesize

                              64KB

                            • memory/460-99-0x0000000008010000-0x0000000008132000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/460-96-0x0000000074DC0000-0x0000000075570000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/460-97-0x0000000004D70000-0x0000000004D80000-memory.dmp

                              Filesize

                              64KB

                            • memory/4520-75-0x00000174FFC10000-0x00000174FFC28000-memory.dmp

                              Filesize

                              96KB

                            • memory/4520-98-0x0000017481930000-0x0000017481940000-memory.dmp

                              Filesize

                              64KB

                            • memory/4520-114-0x00007FFDBB6A0000-0x00007FFDBC161000-memory.dmp

                              Filesize

                              10.8MB

                            • memory/4520-95-0x00007FFDBB6A0000-0x00007FFDBC161000-memory.dmp

                              Filesize

                              10.8MB

                            • memory/4520-80-0x000001749A860000-0x000001749AD88000-memory.dmp

                              Filesize

                              5.2MB

                            • memory/4520-77-0x00000175001D0000-0x0000017500392000-memory.dmp

                              Filesize

                              1.8MB

                            • memory/4520-78-0x00007FFDBB6A0000-0x00007FFDBC161000-memory.dmp

                              Filesize

                              10.8MB

                            • memory/4520-79-0x0000017481930000-0x0000017481940000-memory.dmp

                              Filesize

                              64KB

                            • memory/5684-76-0x0000000004CF0000-0x0000000004D00000-memory.dmp

                              Filesize

                              64KB

                            • memory/5684-83-0x0000000004CF0000-0x0000000004D00000-memory.dmp

                              Filesize

                              64KB

                            • memory/5684-61-0x0000000004DF0000-0x0000000004DFA000-memory.dmp

                              Filesize

                              40KB

                            • memory/5684-60-0x0000000004CF0000-0x0000000004D00000-memory.dmp

                              Filesize

                              64KB

                            • memory/5684-59-0x0000000004D20000-0x0000000004DB2000-memory.dmp

                              Filesize

                              584KB

                            • memory/5684-64-0x0000000004CF0000-0x0000000004D00000-memory.dmp

                              Filesize

                              64KB

                            • memory/5684-58-0x00000000052D0000-0x0000000005874000-memory.dmp

                              Filesize

                              5.6MB

                            • memory/5684-57-0x0000000074DC0000-0x0000000075570000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/5684-115-0x0000000074DC0000-0x0000000075570000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/5684-74-0x0000000074DC0000-0x0000000075570000-memory.dmp

                              Filesize

                              7.7MB

                            • memory/5684-56-0x0000000000470000-0x0000000000478000-memory.dmp

                              Filesize

                              32KB