Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 09:48
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win10v2004-20240508-en
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
d447a0b3326887fffcc4f7c72d6f735a
-
SHA1
4beb5a874077b0af67f07c4235c6b0a4b88bda81
-
SHA256
8f894a68f4e516a7e53aa1ec51b44e88919eee51b6c07e8c6f0663ad2a5206d1
-
SHA512
fc195690f18161a8c6363cca8eb5d440f2304bb883389f0aaa666773b02f97fca7f4808660a72f2441d7494ec346efe5353c20f9d16d528b27d29676874c21dc
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+sPIC:5Zv5PDwbjNrmAE+AIC
Malware Config
Extracted
discordrat
-
discord_token
MTI0MTY4Nzk1NDIzODIxMDA0OA.GKDkfW.mk2fSufaR0ZEQA1k3LCh4NqovodzF-Q5J9WHn8
-
server_id
1241684139892150282
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
taskmgr.exepid process 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 1732 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Client-built.exetaskmgr.exedescription pid process Token: SeDebugPrivilege 3676 Client-built.exe Token: SeDebugPrivilege 1732 taskmgr.exe Token: SeSystemProfilePrivilege 1732 taskmgr.exe Token: SeCreateGlobalPrivilege 1732 taskmgr.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
taskmgr.exepid process 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe -
Suspicious use of SendNotifyMessage 26 IoCs
Processes:
taskmgr.exepid process 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe 1732 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1732-14-0x000001EE57860000-0x000001EE57861000-memory.dmpFilesize
4KB
-
memory/1732-7-0x000001EE57860000-0x000001EE57861000-memory.dmpFilesize
4KB
-
memory/1732-12-0x000001EE57860000-0x000001EE57861000-memory.dmpFilesize
4KB
-
memory/1732-13-0x000001EE57860000-0x000001EE57861000-memory.dmpFilesize
4KB
-
memory/1732-11-0x000001EE57860000-0x000001EE57861000-memory.dmpFilesize
4KB
-
memory/1732-5-0x000001EE57860000-0x000001EE57861000-memory.dmpFilesize
4KB
-
memory/1732-15-0x000001EE57860000-0x000001EE57861000-memory.dmpFilesize
4KB
-
memory/1732-6-0x000001EE57860000-0x000001EE57861000-memory.dmpFilesize
4KB
-
memory/1732-16-0x000001EE57860000-0x000001EE57861000-memory.dmpFilesize
4KB
-
memory/1732-17-0x000001EE57860000-0x000001EE57861000-memory.dmpFilesize
4KB
-
memory/3676-4-0x000001E52C410000-0x000001E52C938000-memory.dmpFilesize
5.2MB
-
memory/3676-1-0x00007FFCBF2A3000-0x00007FFCBF2A5000-memory.dmpFilesize
8KB
-
memory/3676-0-0x000001E511610000-0x000001E511628000-memory.dmpFilesize
96KB
-
memory/3676-3-0x00007FFCBF2A0000-0x00007FFCBFD61000-memory.dmpFilesize
10.8MB
-
memory/3676-2-0x000001E52BC10000-0x000001E52BDD2000-memory.dmpFilesize
1.8MB
-
memory/3676-18-0x00007FFCBF2A0000-0x00007FFCBFD61000-memory.dmpFilesize
10.8MB