discordrat | 5df303a1df4baca2c539771c6d55058c8ff3ef2a790f696d470edfeb06cde1dc

Analysis

max time kernel
56s
max time network
58s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12-05-2024 12:57

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

rizz.exe
Size

78KB
MD5

6ed2528aa8fff43587739f7b2638ee92
SHA1

4148b092d718188de7b4ed127ff64cd7f0be63bf
SHA256

5df303a1df4baca2c539771c6d55058c8ff3ef2a790f696d470edfeb06cde1dc
SHA512

bd5022345d34f1cfd2c55be07b19502b657376f3bd4b98dcf69a02b9cd67f38448b7d69bf2f4c95a3d1f5ebcaa603b7b3d3ca2fc9080b0784726667e5bfdf967
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+xPIC:5Zv5PDwbjNrmAE+hIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTIzOTAzODExOTgxMTIxOTQ4Ng.GFwX-u.vbyy2FgWgxWiAFGiAQUcg_ucSW0DuGYLoG4ZsA
server_id
1239038552336109569

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs

Web Service

T1102

flow	ioc
12	discord.com
29	discord.com
37	discord.com
40	discord.com
60	discord.com
61	discord.com
11	discord.com
59	discord.com
54	discord.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
3648	identity_helper.exe
3648	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3956	rizz.exe
Token: SeShutdownPrivilege	3956	rizz.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 1712	4332	msedge.exe	99
PID 4332 wrote to memory of 1712	4332	msedge.exe	99
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 740	4332	msedge.exe	100
PID 4332 wrote to memory of 2880	4332	msedge.exe	101
PID 4332 wrote to memory of 2880	4332	msedge.exe	101
PID 4332 wrote to memory of 1892	4332	msedge.exe	102
PID 4332 wrote to memory of 1892	4332	msedge.exe	102
PID 4332 wrote to memory of 1892	4332	msedge.exe	102
PID 4332 wrote to memory of 1892	4332	msedge.exe	102
PID 4332 wrote to memory of 1892	4332	msedge.exe	102
PID 4332 wrote to memory of 1892	4332	msedge.exe	102
PID 4332 wrote to memory of 1892	4332	msedge.exe	102
PID 4332 wrote to memory of 1892	4332	msedge.exe	102
PID 4332 wrote to memory of 1892	4332	msedge.exe	102
PID 4332 wrote to memory of 1892	4332	msedge.exe	102
PID 4332 wrote to memory of 1892	4332	msedge.exe	102
PID 4332 wrote to memory of 1892	4332	msedge.exe	102
PID 4332 wrote to memory of 1892	4332	msedge.exe	102
PID 4332 wrote to memory of 1892	4332	msedge.exe	102
PID 4332 wrote to memory of 1892	4332	msedge.exe	102
PID 4332 wrote to memory of 1892	4332	msedge.exe	102
PID 4332 wrote to memory of 1892	4332	msedge.exe	102
PID 4332 wrote to memory of 1892	4332	msedge.exe	102
PID 4332 wrote to memory of 1892	4332	msedge.exe	102
PID 4332 wrote to memory of 1892	4332	msedge.exe	102

C:\Users\Admin\AppData\Local\Temp\rizz.exe
"C:\Users\Admin\AppData\Local\Temp\rizz.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe769746f8,0x7ffe76974708,0x7ffe76974718
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2300,15779891141969333504,17059260037642267989,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2300,15779891141969333504,17059260037642267989,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2300,15779891141969333504,17059260037642267989,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2300,15779891141969333504,17059260037642267989,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2300,15779891141969333504,17059260037642267989,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2300,15779891141969333504,17059260037642267989,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2300,15779891141969333504,17059260037642267989,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2300,15779891141969333504,17059260037642267989,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3416 /prefetch:8
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2300,15779891141969333504,17059260037642267989,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2300,15779891141969333504,17059260037642267989,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2300,15779891141969333504,17059260037642267989,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2300,15779891141969333504,17059260037642267989,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:5240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8e30dd944a18b2f91d0d238988940f4e

SHA1
b6fee9c923185d6ce246d31a8c90ad6b9267548a

SHA256
122502dff86666390a5d0f4d33be7a73b2bd2db9e52ae0756249cdb43d76b21d

SHA512
aba56931076e1dd8f6cbed57945923619c07c476e1d8c289bbff4cdb2ac3ebdc3c746180d2c27d850cd95006eb4a6fa446808cd573561d8f7819e8af5638ce61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fe9e0781ca45d700107d5ff55063c71b

SHA1
23bb7746ba10d7aca160685fbc2cb512d8635bd9

SHA256
15ab77224d96b27f55734bfe09cf5c681e7393d51be89fef1b3b8f9af061409c

SHA512
dd452d5124104c29d4b13d4c1d06a4da2757199e5c7d139a24f02c53217c2a0f06855245ab12bbef02296f6bc067a00e30e7e773ce8c57eb6f80acbd076e3a92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ee993ed63c827a1eeee0a3e9ab554483

SHA1
7ab4266117afc86421e986eccb6265b58b189ec4

SHA256
00e11582cd8467406698e0d1b7f4b46dd9b8f2a2c25d49e532de0144c09e5e14

SHA512
3eef6d60c7136e40c336595c63d41215d976220676174a839d89656f92455d64aa9755263031878c301dcaaff0ab76de899d544c5453bd0f4150681f52eb7188

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
58e34287fd21b4c66d0f60a32f3ca4b6

SHA1
9f489a48e752a7cc058fadfa942123795d2b2832

SHA256
db18aaeec4ce30080fdcfc01e756d64c3046c9304ad2672a8fe47415645f4102

SHA512
be5d71ff610a8ca7cb85b2ceaafac564d95d6ca2c47e8038d03ac6a6b866a94045dbf9d3206f7a909c283caab577a74a4372f3551efacc11c81e6e3a56c2fc28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
91fc1212552f6c32db7758a3d1eca132

SHA1
f7b1430ac62ed34b12b404f55c6b2ecc61be6462

SHA256
cf44d78d1ba3add98ef921f060104e9c749bd429b35cbf228891933d03f94e3c

SHA512
14acf628de2e8470aaba71b5b313b733b62e340face7a60e45d2422f68de1c36329879c246ffede055544113ddf8045acbd95fd46ecea8a72a30aae04c23f423

Download Submit
memory/3956-4-0x000001B2EB500000-0x000001B2EBA28000-memory.dmp

Filesize
5.2MB

Download
memory/3956-45-0x00007FFE7BBA3000-0x00007FFE7BBA5000-memory.dmp

Filesize
8KB

Download
memory/3956-0-0x000001B2E86D0000-0x000001B2E86E8000-memory.dmp

Filesize
96KB

Download
memory/3956-55-0x00007FFE7BBA0000-0x00007FFE7C661000-memory.dmp

Filesize
10.8MB

Download
memory/3956-3-0x00007FFE7BBA0000-0x00007FFE7C661000-memory.dmp

Filesize
10.8MB

Download
memory/3956-2-0x000001B2EAD00000-0x000001B2EAEC2000-memory.dmp

Filesize
1.8MB

Download
memory/3956-1-0x00007FFE7BBA3000-0x00007FFE7BBA5000-memory.dmp

Filesize
8KB

Download