Overview
overview
5Static
static
3BetterDisc...1).exe
windows7-x64
5BetterDisc...1).exe
windows10-2004-x64
5$PLUGINSDI...ge.dll
windows7-x64
1$PLUGINSDI...ge.dll
windows10-2004-x64
1$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3BetterDiscord.exe
windows7-x64
5BetterDiscord.exe
windows10-2004-x64
5LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1d3dcompiler_47.dll
windows10-2004-x64
3ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
3libGLESv2.dll
windows10-2004-x64
3resources/app.js
windows7-x64
3resources/app.js
windows10-2004-x64
3swiftshade...GL.dll
windows7-x64
1swiftshade...GL.dll
windows10-2004-x64
1swiftshade...v2.dll
windows7-x64
1swiftshade...v2.dll
windows10-2004-x64
1vk_swiftshader.dll
windows7-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows7-x64
3vulkan-1.dll
windows10-2004-x64
3Analysis
-
max time kernel
136s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-06-2024 13:57
Static task
static1
Behavioral task
behavioral1
Sample
BetterDiscord-Windows (1).exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
BetterDiscord-Windows (1).exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/BgImage.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/BgImage.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
BetterDiscord.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
BetterDiscord.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
LICENSES.chromium.html
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
LICENSES.chromium.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral14
Sample
ffmpeg.dll
Resource
win7-20240221-en
Behavioral task
behavioral15
Sample
ffmpeg.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral16
Sample
libEGL.dll
Resource
win7-20240508-en
Behavioral task
behavioral17
Sample
libEGL.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
libGLESv2.dll
Resource
win7-20240221-en
Behavioral task
behavioral19
Sample
libGLESv2.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral20
Sample
resources/app.js
Resource
win7-20240221-en
Behavioral task
behavioral21
Sample
resources/app.js
Resource
win10v2004-20240426-en
Behavioral task
behavioral22
Sample
swiftshader/libEGL.dll
Resource
win7-20240221-en
Behavioral task
behavioral23
Sample
swiftshader/libEGL.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral24
Sample
swiftshader/libGLESv2.dll
Resource
win7-20240220-en
Behavioral task
behavioral25
Sample
swiftshader/libGLESv2.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral26
Sample
vk_swiftshader.dll
Resource
win7-20240221-en
Behavioral task
behavioral27
Sample
vk_swiftshader.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral28
Sample
vulkan-1.dll
Resource
win7-20240508-en
Behavioral task
behavioral29
Sample
vulkan-1.dll
Resource
win10v2004-20240508-en
General
-
Target
BetterDiscord.exe
-
Size
112.3MB
-
MD5
673c5e8265f3f9c40e2fc8a4b56744e4
-
SHA1
5d0b271b850f0cd8e01229b1a72a2c1215bc7956
-
SHA256
43894debcd60fed8d64c1a724e60eb860a9d5453b3fc0529ecf9efdbc10a8128
-
SHA512
920c25220fe7d0b6b0079f9856d3931c3dcf93c8c6cf74f1ca1b3946a327093b24c03eb726b4344445b4d386847fc67e9dcf8550c20617a79df75b5d9c3e7483
-
SSDEEP
1572864:AzeRomoaC09nEiziYtpg0Ymr7owq3Ddn35FZevY4v034WZZB0HDh996O/fJaCJpw:geRomF3o3V/ZevY/CHHd+Iq
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
BetterDiscord.exeBetterDiscord.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\International\Geo\Nation BetterDiscord.exe Key value queried \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\International\Geo\Nation BetterDiscord.exe -
Processes:
BetterDiscord.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 BetterDiscord.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 BetterDiscord.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 BetterDiscord.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 BetterDiscord.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 BetterDiscord.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 BetterDiscord.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
BetterDiscord.exeBetterDiscord.exeBetterDiscord.exepid process 2468 BetterDiscord.exe 2556 BetterDiscord.exe 1176 BetterDiscord.exe 1176 BetterDiscord.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
BetterDiscord.exedescription pid process target process PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2584 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2468 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2468 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2468 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2468 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2556 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2556 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2556 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 2556 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 336 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 336 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 336 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 336 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 336 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 336 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 336 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 336 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 336 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 336 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 336 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 336 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 336 1176 BetterDiscord.exe BetterDiscord.exe PID 1176 wrote to memory of 336 1176 BetterDiscord.exe BetterDiscord.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BetterDiscord.exe"C:\Users\Admin\AppData\Local\Temp\BetterDiscord.exe"1⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\BetterDiscord.exe"C:\Users\Admin\AppData\Local\Temp\BetterDiscord.exe" --type=gpu-process --field-trial-handle=1060,9734904575849634716,9737629839115383082,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1068 /prefetch:22⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\BetterDiscord.exe"C:\Users\Admin\AppData\Local\Temp\BetterDiscord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1060,9734904575849634716,9737629839115383082,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1308 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\BetterDiscord.exe"C:\Users\Admin\AppData\Local\Temp\BetterDiscord.exe" --type=renderer --field-trial-handle=1060,9734904575849634716,9737629839115383082,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1500 /prefetch:12⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\BetterDiscord.exe"C:\Users\Admin\AppData\Local\Temp\BetterDiscord.exe" --type=gpu-process --field-trial-handle=1060,9734904575849634716,9737629839115383082,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1960 /prefetch:22⤵PID:336
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b945566aa6c64d64afd6220a9ee17c86
SHA129df3e9cceef82fafc7d257031cefaf7944f2755
SHA25633a1ad63fa9c3ed227f659ce4e6c6165527ae48654ff4ca1b15a01956431c0c9
SHA5121054783afba3b7d7059422f8d89534135c8fbd068c8f44b82a822fcfdafece79fd5ade2d603b881b04a5b3aaf7d8b14c0dd9a53825e6b9d1bf99ae8ca6af1576
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b