Analysis
- max time kernel
46s - max time network
32s - platform
windows7_x64 - resource
win7-20240508-en - resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system - submitted
30/05/2024, 16:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
leokadia film/leosia s4pm.exe
Resource
win7-20240508-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
leokadia film/leosia s4pm.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target leokadia film/leosia s4pm.exe
- Size 1.1MB
- Sample240530-th5wpsdf91
- SHA256 f9c95d44186d306f43e7c7b0be319d9feaba04226ce016b56949916c5185c007
- MD5 3d988d51bb78c7f05d1d9d621704bd8b
- SHA1 63d9eb61ef9c3a8c06e551651b8ad191f5cbe5a6
- SHA512 c6ccf1423ab8bb6821521810b1247b288bb27dd00047a9deb5dc81be215a9a70f41bc44efce93638056e3a20b9f6efa2b552dae0b2483b613d5302bbcad25a62
- SSDEEP 24576:9uDXTIGaPhEYzUzA0x4w0LzbUNfGL4w0LzbUNHFMkcY4VV+XqyPJcOtk3MrS6y:gDjlabwz9Wvb8vbgFxcYZXfX+kS6y
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTI0MzY3MDczMTU5MDcyOTc5OQ.G25Fr1.zUYZMU8iXioqif_5Uws8Eat0XjMaXMVbm9OT_0
-
server_id
1243671022599802944
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Executes dropped EXE 1 IoCs
pid Process 1256 Client-built.exe - Loads dropped DLL 6 IoCs
pid Process 2140 leosia s4pm.exe 2560 WerFault.exe 2560 WerFault.exe 2560 WerFault.exe 2560 WerFault.exe 2560 WerFault.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2732 vlc.exe - Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2732 vlc.exe 2856 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: 33 2732 vlc.exe Token: SeIncBasePriorityPrivilege 2732 vlc.exe Token: SeDebugPrivilege 2856 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe - Suspicious use of SendNotifyMessage 52 IoCs
pid Process 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2732 vlc.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe 2856 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2732 vlc.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2140 wrote to memory of 1256 2140 leosia s4pm.exe 28 PID 2140 wrote to memory of 1256 2140 leosia s4pm.exe 28 PID 2140 wrote to memory of 1256 2140 leosia s4pm.exe 28 PID 2140 wrote to memory of 2732 2140 leosia s4pm.exe 29 PID 2140 wrote to memory of 2732 2140 leosia s4pm.exe 29 PID 2140 wrote to memory of 2732 2140 leosia s4pm.exe 29 PID 1256 wrote to memory of 2560 1256 Client-built.exe 30 PID 1256 wrote to memory of 2560 1256 Client-built.exe 30 PID 1256 wrote to memory of 2560 1256 Client-built.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\leokadia film\leosia s4pm.exe"C:\Users\Admin\AppData\Local\Temp\leokadia film\leosia s4pm.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\leokadia film\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\leokadia film\Client-built.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1256 -s 5963⤵
- Loads dropped DLL
PID:2560
-
-
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\leokadia film\leokadia.mp4"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2732
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2856
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\leokadia film\Client-built.exe
- Size 78KB
- SHA256 cf49718a7221223c4ac270b07f1775f82424a2edda1788fa47a743249c9ebe1b
- MD5 2a562de28a4a276c5fd1496b298bf78c
- SHA1 fa9be444f9dd748c9e244f9590e210322d619127
- SHA512 28aede7a8c9572a5f1d68ff32b7fe4a47c8382f958f71df6cf5425e5e4ecc015c321b697334790b5f0615455761ace07854213dff0d1c3536c3ebeea5a851d59
- SSDEEP 1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+IPIC:5Zv5PDwbjNrmAE+MIC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\leokadia film\leokadia.mp4
- Size 470KB
- SHA256 04d524c0b369b29199bb956576c18be7933ad25db9a836e205d48850fb664fdb
- MD5 1e98d436a0b9f09aa3944e545ec8764d
- SHA1 f9c1aa370097c6849349d2453419e19be2e48eac
- SHA512 387fa769d3f8c78efc36a76eb464dd548e4c7acd0e46eeacc2c324f343773e976d7aca18cb0b16379f5cb2a06def9f09fbe80d038a001d688b2d4321999b95d2
- SSDEEP 12288:iyHk1ianlQbGgPMYG0tJXRWYTY0gWP/xicuzMbnUqo4Hn+:iyHuiaebXB1WYTOyxicuzu/BH+
- MD5 SHA1 SHA512 SSDEEP