Resubmissions
Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
04-06-2024 10:27
Behavioral task
behavioral1
Sample
GTA5-FINAL-RELEASE.exe
Resource
win11-20240508-en
windows11-21h2-x64
13 signatures
150 seconds
General
-
Target
GTA5-FINAL-RELEASE.exe
-
Size
78KB
-
MD5
7ca4d82e1aa342c82da6007947163259
-
SHA1
7875f56bcbb94747c85a54f8bdd465d866e01965
-
SHA256
689481c56c91f86cf9e6d034cb714e3c92723af3035c00c3c339fcb384258e55
-
SHA512
1685a6a2169d1ff6daec4de8c4d48d6035048e2604ff28b4aef6de168785d28c60793d417b9d29bb5e81831c595871f9cdee1aed1eec5f1cbb4dd8f5f746b633
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+APIC:5Zv5PDwbjNrmAE+kIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI0Njg5OTQxNDg5NTk1MTk4Mw.Gcxhsz.QV1m4KTtP0M77UZ2GaIPNr05TtimA7gY4NjqcQ
-
server_id
1246899988789989576
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Disables Task Manager via registry modification
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
flow ioc 3 discord.com 5 discord.com 67 discord.com 70 discord.com 1 discord.com -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe -
Modifies registry class 25 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\MinPos1280x720x96(1).y = "4294967295" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WFlags = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\HotKey = "0" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\NavBar = 000000000000000000000000000000008b000000870000003153505305d5cdd59c2e1b10939708002b2cf9ae6b0000005a000000007b00360044003800420042003300440033002d0039004400380037002d0034004100390031002d0041004200350036002d003400460033003000430046004600450046004500390046007d005f0057006900640074006800000013000000cc0000000000000000000000 explorer.exe Key created \Registry\User\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\NotificationData explorer.exe Key created \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WinPos1280x720x96(1).top = "39" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\MinPos1280x720x96(1).x = "4294967295" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\MaxPos1280x720x96(1).x = "4294967295" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\MaxPos1280x720x96(1).y = "4294967295" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WinPos1280x720x96(1).left = "246" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings control.exe Key created \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WinPos1280x720x96(1).bottom = "639" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WinPos1280x720x96(1).right = "1046" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\ShowCmd = "1" explorer.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1664 explorer.exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1664 explorer.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 5104 GTA5-FINAL-RELEASE.exe Token: SeShutdownPrivilege 1636 control.exe Token: SeCreatePagefilePrivilege 1636 control.exe Token: SeDebugPrivilege 2388 taskmgr.exe Token: SeSystemProfilePrivilege 2388 taskmgr.exe Token: SeCreateGlobalPrivilege 2388 taskmgr.exe Token: 33 2388 taskmgr.exe Token: SeIncBasePriorityPrivilege 2388 taskmgr.exe Token: SeDebugPrivilege 4492 taskmgr.exe Token: SeSystemProfilePrivilege 4492 taskmgr.exe Token: SeCreateGlobalPrivilege 4492 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1664 explorer.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe 4492 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1664 wrote to memory of 2388 1664 explorer.exe 88 PID 1664 wrote to memory of 2388 1664 explorer.exe 88 PID 1664 wrote to memory of 4264 1664 explorer.exe 89 PID 1664 wrote to memory of 4264 1664 explorer.exe 89 PID 1664 wrote to memory of 4492 1664 explorer.exe 90 PID 1664 wrote to memory of 4492 1664 explorer.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\GTA5-FINAL-RELEASE.exe"C:\Users\Admin\AppData\Local\Temp\GTA5-FINAL-RELEASE.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5104
-
C:\Windows\system32\control.exe"C:\Windows\system32\control.exe" /name Microsoft.AdministrativeTools1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1636
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵PID:4076
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /72⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2388
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /72⤵PID:4264
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /72⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4492
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD59e466b4837d8431be725d6b9c1b4d9ef
SHA13f247b7c89985a41d839cad351cd0fc182fcb284
SHA2562f9a5eeb5ac8cec52a3e73621e4d392f501f5d657dfec3215ccd40eec317208d
SHA51201de0fda555d63b5c38339b0f6d38c28de2a882643439679e63cf5d75f13516b57dc90e8dfb8c638bda328fc12342e58d1e501acec8f85b92dbd5589dac06418
-
Filesize
4B
MD5f49655f856acb8884cc0ace29216f511
SHA1cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA2567852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
-
Filesize
960B
MD516846df493521e84fe47cd6b6451ec8f
SHA16d99eb017c5aec08d3a7e908bbd4a051ce250c02
SHA25669f19f2ab2f3625faca623477864766ab1ef3a21712bc892d7b2b0886585b3f9
SHA512aefa5121601b8273cff6b79b7f76417c71e29e835b66faf3e1a67d0d38fb9ebe90320b75493fd5c4a2d9ea3e3c485d0a84bcdbfb78c26a8ecee3175cd8bd93cd
-
Filesize
14KB
MD546e73ffc1e2868a135b3581527fc9b0f
SHA10b7abe15db8fc80d224dabcc087dd7dd0df6acd0
SHA25622522f90bf0e9892dfc52430f72dc8274c9497c7f016043580eab6d5d02223a9
SHA51223b09612e20ad18498066d59e726e26eab1fe9b93ac1114ae32b1325254538a2f9e3fe86a8387684bd32d114d11936ebf4e071008838bf76eb211e965d07842f