Analysis
-
max time kernel
383s -
max time network
423s -
platform
windows10-1703_x64 -
resource
win10-20240404-de -
resource tags
-
submitted
17-05-2024 11:18
General
-
Target
spoofer/spoofer.exe
-
Size
78KB
-
MD5
a588fc073017f17b9538be0d7950fe8b
-
SHA1
db71c1ad51e13f38c5342fa2c84fa45221176839
-
SHA256
5b25158dadc5ac21c99c100eb9c49f86898dc19959e045f131414ee1e52fe2f1
-
SHA512
08bdf70710d8e5330f824f971a5585e0b2b3a6516c0a59f5c00fe175b681ecbf25a354c64e1bcb9cb1d5fd0c6401e765355c416e0b860e8da0a4ff72e32ca1f5
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+LPIC:5Zv5PDwbjNrmAE+jIC
Malware Config
Extracted
discordrat
-
discord_token
MTI0MDcyOTAxNzg4ODUzODY1NA.Grdfmd.TkiEwQyP2bUA1RIGNTE-wkWpyVRP_iGf-NHIsI
-
server_id
1240883770677264404
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
-
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Disables Task Manager via registry modification
-
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 32 IoCs
-
Drops file in System32 directory 18 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Windows directory 7 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 16 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Modifies data under HKEY_USERS 18 IoCs
-
Modifies registry class 27 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 20 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of UnmapMainImage 41 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{f51d469f-1640-4bbc-b757-8d38cb77068f}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3afa055 /state1:0x41c64e6d2⤵
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s LSM1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog1⤵
- Drops file in System32 directory
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s nsi1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s EventSystem1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
-
c:\windows\system32\sihost.exesihost.exe2⤵
- Modifies registry class
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s NlaSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted1⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4142⤵
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s netprofm1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k appmodel -s StateRepository1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent1⤵
- Modifies data under HKEY_USERS
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
- Suspicious use of AdjustPrivilegeToken
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s CryptSvc1⤵
- Drops file in System32 directory
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s TokenBroker1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\spoofer\spoofer.exe"C:\Users\Admin\AppData\Local\Temp\spoofer\spoofer.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\NetSh.exe"NetSh.exe" Advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -Command Add-MpPreference -ExclusionPath "C:\"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C whoami3⤵
-
C:\Windows\system32\whoami.exewhoami4⤵
-
-
-
C:\Windows\SYSTEM32\SCHTASKS.exe"SCHTASKS.exe" /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I3⤵
-
-
C:\Windows\System32\shutdown.exe"C:\Windows\System32\shutdown.exe" /s /t 03⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /72⤵
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s CDPSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Modifies data under HKEY_USERS
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s wlidsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\ApplicationFrameHost.exeC:\Windows\system32\ApplicationFrameHost.exe -Embedding1⤵
- Suspicious use of UnmapMainImage
-
C:\Windows\System32\InstallAgent.exeC:\Windows\System32\InstallAgent.exe -Embedding1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}1⤵
-
C:\Windows\ImmersiveControlPanel\SystemSettings.exe"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe"C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 624 -s 16842⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{7E55A26D-EF95-4A45-9F55-21E52ADF9887}1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtCreateUserProcessOtherParentProcess
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\25b42cbf06d848e7a4225b3be68c1ef0 /t 3044 /p 45202⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe"C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2136 -s 16802⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD5cb363e362c294cfab877152fd1adaaed
SHA148c52561f145fadcfe149d49e3d8cf87463f280d
SHA256baa73dee9df97bd4439c75b027110d1d2ff95c2d5ce2efdb0a5dcdade3ed8a65
SHA5120c04149a61dfb0e7d2d705cacfe9673153f3476e8e647830c4b38989dac1edc010ce9c2f3941d301ba5085da6d3b012d41a9eb5714613a12808101bf922dad62
-
Filesize
12KB
MD52143406193e94e7dfebffe6b8ef93522
SHA108735158efacabab7207a4bfef8cbe1077e49a3f
SHA256286b95c6616711839dd060bbca28494ace1c6ba68db5882882fb2f936588b5eb
SHA5129e38b57ff7494cc7e57055802028a200671647dde2f26063fb797c96004615dea713334cb27551f9fe3618c328e276fb32335168edc0d62e8d8979a75e1ce942
-
Filesize
32KB
MD5e9d20523a0cd345418421324507f3149
SHA1f6c9eb2d0abe1b080c0606f198ab8b91e83d1895
SHA2561f04b081a15843491f74ee8ba8d3fa711a1f290acd5a67639b767530bb478ffd
SHA512ddf4ecfe4ba4ecdfdbec16c0d75cbad8146fba61503ff6e120b5bae22fdec35ca7956b50aee78abd52cd4bc5e78d64aed341599e6b2f1c07c571eff70f9f5065
-
Filesize
12KB
MD5959aa6ed420d413b0fb7e360e760d806
SHA1a567d51f96f833e72c01ee4299fca025f708306b
SHA2563e362c944ea7609010b2d45478c20013b4d104b1fd2f3d390229fea61f7b0827
SHA512d79a4b78475e48983c3926f64490915860ddfe1b6bd874b7493ea32f1b33d8d31a7b32c3a734c5ebf3c2b1b4c27a862a4b49f9ead0a2911f9570df6d28079ef7
-
Filesize
31KB
MD53d76cc18b2c469de79a2c96bff2909bb
SHA1eaa38ee504c3d06800ac3111b41b1267e020e6d7
SHA25635bda1c1e3a95602d13c614e91edbc949695f87170c4e532dc970fd5df8c05bb
SHA512695159f5e22e71cb90f62decbb7faea40b02893fa588eb2f5cf6d1c2c0583cffcb7a46fc9c31467f60f137b65b7d4c5b952b88dfe42df55d0e74751465a5cdcb
-
Filesize
12KB
MD5658328e11d6988ec34c91f4e0abf5ea1
SHA1414d02090d7d663079673416b422e69eec9dd2e3
SHA256dc730988f77d0f2e88fd81acce2a89798e37e8d03a10b704804aa7a8f7e156a4
SHA5126ed8e2740c2c6252c92e44028fe5a94a63997503e1c03261e787d4f683f02984e746bc8ca3dc326dfeebcc100cb998609ac21fdcb0bebec3f875ee37c3bbe9ac
-
Filesize
338B
MD54a673ecdaf8b070718cc34a72146b973
SHA1ceca735afdd0e22eed22b463593ac2bdfed368d0
SHA256472cf32889af656436388e3c06332b9aacf09a302eb0b5568edd126b0f9ce1ea
SHA5129991da51107044e44c69445a3d2c1956645b1f570f92f11b14d4f38c5b075d45414cafce4252734773617d1b68dc3c86bae9f2f9caead6b711ed30557018f37d
-
Filesize
404B
MD50bffc24101feb9271947fbeed75fe047
SHA1d992ae691f2114134eae3c902ae09613eccabc72
SHA256d0a1722ffed9730b6a493a4992d7267c311e18bbc3ef8fa69f032ad62d4a008f
SHA512d9e9da46b0b1d9cfb973486bc88de93ca1e1df326a44c301b92084ed2a73588f9183aff71abe8f50e90fe98f547c176ae267a25cbc3e219e06ee953ee19baeb6
-
Filesize
629KB
MD55cd3313eed51144ce9362142e68b875e
SHA12c6bc5c4674c024777bfa0a34a2a55358dba8b17
SHA2568fc7c5faac253795ebc18b50d5b1d99139b95657454d43310c2b508dfe0e42bf
SHA5126ab986b9b53aeaf0e8c9d2d5230aa74defff51b07534cdbcfe3c2322914517e84bb76e2f1e3f1dfdad674fc60ff54ffb8d5dd55a7deddeb0b6f16317f83219ba
-
Filesize
8KB
MD5c395cd69b578a96877d02cb0f547e165
SHA1109c889ebaee62ba140fc36434d87d6ac8ebf424
SHA25609a4276252f9f8147362ec98ba9c8a1a822e58fa1d3fa102187a9947b5506868
SHA512295612e8bb3d5dd1f04c83a431534d445636a3ae40821aeedbba01b3bc8bf87f538d933b932f1f43095b361afc7b7bba1d07e6f96cefb35ebc5c3dc2f87f2a2f
-
Filesize
70KB
MD5dc37deff2947a4ec8bf9b40a3dc25c49
SHA1422bdce2dc21c634760c8b06a60c4ebf131cc592
SHA25600dee1b03565baf7c105f1484f27a2e04d900538c153372482fbedd8cde61d85
SHA512bbe9730344e0f648c53d2d5c518791ce8d92c1f04e1b9646bb4feca24d5f41fae255eff57ad7c36ff1d26869ad25eede25bbd4e98a59267d41ee71f3885d9dd4
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
940B
MD5d6e62104a0d8615886fa0082351338ce
SHA1ef6dc821685efb710fbe07e17d2331bb923a3ef1
SHA256f466046757652072c334641bb374b2344dc0ef0c9c2b1473aa58499138639006
SHA512b64796db9181abeceb1d3fb379a81a8244d8a12482cf1618d2a063c2d57db57c15d670bdc5507d1f86e48b91686a68676b2574658faa130d484fcf0003d16e78
-
Filesize
412B
MD5c4b57dace92ff16ff1d54614dafbe40b
SHA12fb9d3014a081e5b1c581a2f6d4bee46cc97d249
SHA2567bffdea7226b105c649f885c232f55ef93bd22d8b1bbad7a96ea137bb0f7342b
SHA5124c2505aaf29d95ffedcc073e06b50242e553ef0ba5211f265202adf61185b3cea992659a53ad013a69cc62e402081d302a1ba70563c939ff293e1d7258a2ba87
-
Filesize
168KB
-
Filesize
140KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
696KB
-
Filesize
1.1MB
-
Filesize
256KB
-
Filesize
1.9MB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
5.1MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
1.9MB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
264KB
-
Filesize
56KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
696KB
-
Filesize
248KB
-
Filesize
2.8MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
1.0MB
-
Filesize
680KB
-
Filesize
168KB
-
Filesize
64KB
-
Filesize
472KB
-
Filesize
136KB
-
Filesize
64KB
-
Filesize
536KB