Resubmissions

05-05-2024 21:29

240505-1b69hsed8z 1

05-05-2024 21:18

240505-z5mxaseb71 10

Analysis

  • max time kernel
    45s
  • max time network
    47s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-05-2024 21:18

General

  • Target

    https://mega.nz/file/vo1kAZzQ#RvkHJ8LY-8Qvzc8eEB5V_0BrjDg7SKpK8StNIEDQ1OU

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTIzMTk3MDk2MzI2OTM1MzUwMw.GCKF72.2CjYBr0SlSXhyKJw5YlPZ3DqCNZJg1115seOyk

  • server_id

    1235212540905132063

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 28 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 35 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/vo1kAZzQ#RvkHJ8LY-8Qvzc8eEB5V_0BrjDg7SKpK8StNIEDQ1OU
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4036
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe39fc46f8,0x7ffe39fc4708,0x7ffe39fc4718
      2⤵
        PID:2192
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,15345124327623153603,1817849616950300060,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
        2⤵
          PID:4580
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,15345124327623153603,1817849616950300060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3920
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,15345124327623153603,1817849616950300060,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
          2⤵
            PID:2140
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15345124327623153603,1817849616950300060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
            2⤵
              PID:3176
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15345124327623153603,1817849616950300060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
              2⤵
                PID:4140
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,15345124327623153603,1817849616950300060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
                2⤵
                  PID:4760
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,15345124327623153603,1817849616950300060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:860
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2080,15345124327623153603,1817849616950300060,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5516 /prefetch:8
                  2⤵
                    PID:3476
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15345124327623153603,1817849616950300060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
                    2⤵
                      PID:1308
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15345124327623153603,1817849616950300060,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
                      2⤵
                        PID:4376
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2080,15345124327623153603,1817849616950300060,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6040 /prefetch:8
                        2⤵
                          PID:212
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15345124327623153603,1817849616950300060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
                          2⤵
                            PID:2044
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2080,15345124327623153603,1817849616950300060,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6404 /prefetch:8
                            2⤵
                              PID:5232
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15345124327623153603,1817849616950300060,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6532 /prefetch:1
                              2⤵
                                PID:5352
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,15345124327623153603,1817849616950300060,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1
                                2⤵
                                  PID:5360
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2080,15345124327623153603,1817849616950300060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5560 /prefetch:8
                                  2⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:5568
                                • C:\Users\Admin\Downloads\HackTool.exe
                                  "C:\Users\Admin\Downloads\HackTool.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5680
                                • C:\Users\Admin\Downloads\HackTool.exe
                                  "C:\Users\Admin\Downloads\HackTool.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:6040
                                • C:\Users\Admin\Downloads\HackTool.exe
                                  "C:\Users\Admin\Downloads\HackTool.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5316
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:1952
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:1580
                                  • C:\Windows\system32\AUDIODG.EXE
                                    C:\Windows\system32\AUDIODG.EXE 0x4e0 0x4b0
                                    1⤵
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4332

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                    Filesize

                                    152B

                                    MD5

                                    8b2290ca03b4ca5fe52d82550c7e7d69

                                    SHA1

                                    20583a7851a906444204ce8ba4fa51153e6cd494

                                    SHA256

                                    f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

                                    SHA512

                                    704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                    Filesize

                                    152B

                                    MD5

                                    919c29d42fb6034fee2f5de14d573c63

                                    SHA1

                                    24a2e1042347b3853344157239bde3ed699047a8

                                    SHA256

                                    17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

                                    SHA512

                                    bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    72B

                                    MD5

                                    7fd748ded9b298594822a6848c000d5f

                                    SHA1

                                    8ab3c1b1b2543dc40a42f77bfca7676b71d5e0d5

                                    SHA256

                                    35ac266fd1afa99a3534ad795d96d5223a9011dba7d4d31f947e91352040ae87

                                    SHA512

                                    0585221d649945041210f7a2eb2c3b84699dc87631d64b1bce43254a3c160db3d2ef1a0a5186739e701059d58b556c18ed49ef4c9a9ce14722eeb7538ca20f9e

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

                                    Filesize

                                    16B

                                    MD5

                                    46295cac801e5d4857d09837238a6394

                                    SHA1

                                    44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                    SHA256

                                    0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                    SHA512

                                    8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    6KB

                                    MD5

                                    1d484e342a82f96a648d19d0baa156df

                                    SHA1

                                    c1fc00672e08c711015237c11d9f3eae73babc35

                                    SHA256

                                    fe7c9783df8c0127f7929eb818e1ca2ac6aeb4b0939a7011d34b509d271e4b52

                                    SHA512

                                    656d75708e852c2a607005c3adcccc87bae4797ddaee7d1d76f0443d89afa040932580247578b4967db2762d0b41e9f949b8b566653774fe5a818c00b24a202a

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                    Filesize

                                    5KB

                                    MD5

                                    83d5dd58f7447123c880760f0699270d

                                    SHA1

                                    9eb50c40ed920557f9c7619f05a78aa2a2dd5c94

                                    SHA256

                                    ddd2913f5db617c22618f8109ae168591eb0bcc3b6b628cd58cd747c3c8e2353

                                    SHA512

                                    9da432481b2781d911adbbdd20ccd5abeeda6d8f84f599b62e7270733420a41b736c81718f59c1746737c6e71dce57dee83aab0e688a33739fa7205453df2870

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

                                    Filesize

                                    41B

                                    MD5

                                    5af87dfd673ba2115e2fcf5cfdb727ab

                                    SHA1

                                    d5b5bbf396dc291274584ef71f444f420b6056f1

                                    SHA256

                                    f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                    SHA512

                                    de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                    Filesize

                                    72B

                                    MD5

                                    90875fff8016b1b893087a39749ae965

                                    SHA1

                                    7630d054eb88cbe360e63c8a99a4be0d9bcbf7b0

                                    SHA256

                                    968f3cbae5838a0c09f367f9a9e457c5e1eb198c27a16661d00f1974b81a08c9

                                    SHA512

                                    e9540ebf49101d864e653c57a50f68e736e277914913c768a10afe4819579de4f798faf043c1bc1784021b45c04c6f0759e3c3762cf4e3686ac9c20c1b8a34ca

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe579b27.TMP

                                    Filesize

                                    48B

                                    MD5

                                    0c288b0368be0f3ff99622a5cc8ee12b

                                    SHA1

                                    cfd1561f10a225bed4ccf14f33c785a13814e2be

                                    SHA256

                                    d1fea9cf6d80d9dd91c23998132f24263d20e8f4512bd045af3cd517b2f1137e

                                    SHA512

                                    f724a1e1a7292b8132496d3ca4d250e2c4b04e6d9905d9456b430fd320fd53687660608cf83f4a186843d6d71cd3a4d3eaff43133757bed03d2023b414cfe94d

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                    Filesize

                                    16B

                                    MD5

                                    6752a1d65b201c13b62ea44016eb221f

                                    SHA1

                                    58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                    SHA256

                                    0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                    SHA512

                                    9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                    Filesize

                                    11KB

                                    MD5

                                    6b518658d97b496f75cc712d1b47fdb5

                                    SHA1

                                    da3128e1cf20d13af834c4f59dd5f87ea912484c

                                    SHA256

                                    61ea37996ac2045e2c1fbd123eb0c0f1478832c5a67f48d873e80a2383441cee

                                    SHA512

                                    2620d254d5a6d4ad844023aad1422878b4174e604404c0c55e883d97232126b2c03ce0086a5ed7b873e55a4f411101ea8021ce87bfbb0ad5014863232d84e3a2

                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                    Filesize

                                    11KB

                                    MD5

                                    cc65dee158608079626ff8871c13bf7a

                                    SHA1

                                    d9fd10bdde50805b95427cc3f9a824a4b95917d6

                                    SHA256

                                    05b0f761188d7db02544c3ff8970451fe69f145993c6608339f18afea2b29206

                                    SHA512

                                    7be58de3cff976072fcbbabae463a6fb944a1042286460a715ecf9f06ddb9f500aedf5a5dd7217e48ff91e8408ecfa49f9e8029820753cf332fc596872195c98

                                  • C:\Users\Admin\Downloads\HackTool.exe

                                    Filesize

                                    78KB

                                    MD5

                                    a3a4af63840799e8e528abbc248ed56e

                                    SHA1

                                    2d6a2bc38cd73933f36e8da7f161c9e623058134

                                    SHA256

                                    eb38772e4f8cb9748499b12ffc69771b030610af2ee642fbfb5ebf18a6f35b96

                                    SHA512

                                    d358942f458094dca079e66bbccff91abcf4dc959c3dab3912c74c7981f3e4544f7512e83c1172d876a4218f1b2615fbd63f16d9cf669e4843edcdb86452dfde

                                  • memory/5316-221-0x000002B7A8480000-0x000002B7A874A000-memory.dmp

                                    Filesize

                                    2.8MB

                                  • memory/5680-179-0x0000020BC1FB0000-0x0000020BC2172000-memory.dmp

                                    Filesize

                                    1.8MB

                                  • memory/5680-180-0x0000020BC27B0000-0x0000020BC2CD8000-memory.dmp

                                    Filesize

                                    5.2MB

                                  • memory/5680-213-0x0000020BC2280000-0x0000020BC22F6000-memory.dmp

                                    Filesize

                                    472KB

                                  • memory/5680-215-0x0000020BA9540000-0x0000020BA9552000-memory.dmp

                                    Filesize

                                    72KB

                                  • memory/5680-216-0x0000020BA95D0000-0x0000020BA95EE000-memory.dmp

                                    Filesize

                                    120KB

                                  • memory/5680-178-0x0000020BA7940000-0x0000020BA7958000-memory.dmp

                                    Filesize

                                    96KB

                                  • memory/6040-217-0x0000022F19740000-0x0000022F19752000-memory.dmp

                                    Filesize

                                    72KB