Analysis
-
max time kernel
52s -
max time network
54s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
31-05-2024 21:37
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
7f755065cad905389dafe07f6e20e73f
-
SHA1
7f9e8c2f562b6188082fdbaf71c32f0da356dc96
-
SHA256
71d721537769fce1df1ccc3fd010a23655e558e90dadc50fb153cf3d5bfbccf3
-
SHA512
0e540fa60e52bec83d11c353ac5447586ca71534ec5d81b4f4be941ed28e363fbd380ede88a94b9d9d84e39486c11d9a45be6497bfe07a424fe436bc4faf2f92
-
SSDEEP
1536:A2WjO8XeEXFu5P7v88wbjNrfxCXhRoKV6+V+APIC:AZQ5PDwbjNrmAE+kIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
https://canary.discord.com/api/webhooks/1246215833953505412/9uXKZChffplNEDpn0FQSblZ-X9VTnpusfXJXgPLFJdJTmsErgGeosG6esqtb_YHLiRZo
-
server_id
1246211698583670787
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4020 Client-built.exe Token: SeDebugPrivilege 4608 taskmgr.exe Token: SeSystemProfilePrivilege 4608 taskmgr.exe Token: SeCreateGlobalPrivilege 4608 taskmgr.exe Token: SeDebugPrivilege 1944 Client-built.exe Token: SeDebugPrivilege 1332 Client-built.exe -
Suspicious use of FindShellTrayWindow 57 IoCs
pid Process 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe -
Suspicious use of SendNotifyMessage 57 IoCs
pid Process 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe 4608 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4020
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4608
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1944
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1332