Analysis
-
max time kernel
149s -
max time network
136s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
16-05-2024 12:47
Behavioral task
behavioral1
Sample
Doomsday 2.0.exe
Resource
win10-20240404-en
windows10-1703-x64
10 signatures
150 seconds
General
-
Target
Doomsday 2.0.exe
-
Size
78KB
-
MD5
db5a4df36bf2c8246c83de8198d38fdd
-
SHA1
2845da0509b98124763e5d695113d0b2c766446b
-
SHA256
2d832c588c8c3b04ced93e9d057f78865174b222276d94b344ef9ffb1e395743
-
SHA512
a6b9361d2cf6a0694a3d9dfcfd152c3e12e17885bf61915f37830bf874ec750bbc3bc498e0f9ca55bda251cec231ea3502e79f93f20f1e10867b913a3ecbc285
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+ZPIC:5Zv5PDwbjNrmAE+pIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI0MDY0NTc2MzY1OTIwNjcyNg.GJlaHg.NUriYPGM5L_GnVLljACN7pxT0nzmvkPLpMp65A
-
server_id
1232350852556128387
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3476 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1352 Doomsday 2.0.exe Token: SeDebugPrivilege 3476 taskmgr.exe Token: SeSystemProfilePrivilege 3476 taskmgr.exe Token: SeCreateGlobalPrivilege 3476 taskmgr.exe Token: SeDebugPrivilege 4176 Doomsday 2.0.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe 3476 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Doomsday 2.0.exe"C:\Users\Admin\AppData\Local\Temp\Doomsday 2.0.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1352
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3476
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\Doomsday 2.0.exe"C:\Users\Admin\AppData\Local\Temp\Doomsday 2.0.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4176