Analysis
- max time kernel
128s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
12/05/2024, 14:30
Errors
General
- Target Client-built.exe
- Size 78KB
- Sample240512-rt4rnsde76
- SHA256 a357809e2125e8e840c0dc8b091b564b668b38f016d05629a5fb070d20e401f9
Malware Config
Extracted
-
discordrat
-
discord_token
MTIyNjg0MzM1NDk2OTY2OTY5Mg.Gy9KZQ.NY-KwcbQ8yEx9fTi-etQyNnQ0BqzTHoeJ9s1Eo
-
server_id
1225922728725581906
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies data under HKEY_USERS 15 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Client-built.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\Client-built.exe'" /sc onlogon /rl HIGHEST2⤵
- Creates scheduled task(s)
-
-
C:\Windows\System32\shutdown.exe"C:\Windows\System32\shutdown.exe" /r /t 02⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa394a855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3756-0-0x000001D11AFE0000-0x000001D11AFF8000-memory.dmp
memory/3756-1-0x000001D135690000-0x000001D135852000-memory.dmp
memory/3756-2-0x00007FF8B1970000-0x00007FF8B1CC5000-memory.dmp
memory/3756-3-0x000001D135F80000-0x000001D1364A8000-memory.dmp
memory/3756-4-0x00007FF8B1970000-0x00007FF8B1CC5000-memory.dmp
memory/3756-5-0x00007FF8B1970000-0x00007FF8B1CC5000-memory.dmp