Analysis
-
max time kernel
149s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 09:46
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
d447a0b3326887fffcc4f7c72d6f735a
-
SHA1
4beb5a874077b0af67f07c4235c6b0a4b88bda81
-
SHA256
8f894a68f4e516a7e53aa1ec51b44e88919eee51b6c07e8c6f0663ad2a5206d1
-
SHA512
fc195690f18161a8c6363cca8eb5d440f2304bb883389f0aaa666773b02f97fca7f4808660a72f2441d7494ec346efe5353c20f9d16d528b27d29676874c21dc
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+sPIC:5Zv5PDwbjNrmAE+AIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI0MTY4Nzk1NDIzODIxMDA0OA.GKDkfW.mk2fSufaR0ZEQA1k3LCh4NqovodzF-Q5J9WHn8
-
server_id
1241684139892150282
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 448 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3528 Client-built.exe Token: SeDebugPrivilege 448 taskmgr.exe Token: SeSystemProfilePrivilege 448 taskmgr.exe Token: SeCreateGlobalPrivilege 448 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe 448 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3528
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:448