Analysis
-
max time kernel
144s -
max time network
136s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
08-06-2024 22:53
Behavioral task
behavioral1
Sample
newgame.exe
Resource
win10-20240404-en
windows10-1703-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
newgame.exe
Resource
win10-20240404-en
windows10-1703-x64
8 signatures
150 seconds
General
-
Target
newgame.exe
-
Size
86KB
-
MD5
da73d03e7e63df84355ca62baaefae8a
-
SHA1
4a24296ce0275ab6d5439a155a17d8de80d549d5
-
SHA256
16cef3c03efe6d11b261709e330058536b7bd186fad81e932f2a9db1cef78610
-
SHA512
7d8c28fa0ee62228104af1bd25aefe3f18fea9e9983d1cbcfa2f18f9f2832c5471fe4f545e775f6ed775802b3d687d81c1a14292af3406f6ef613c39e0c617e7
-
SSDEEP
1536:t2WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+UPIoC1:tZv5PDwbjNrmAE+IIoe
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI0NzYwNjA2ODE3NTk2MjEzMw.G3Bv2h.Oi-mmhg6ZK_uTFZKjQiDOwr-wcEm-Hq0xizKtQ
-
server_id
1247606720864321577
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
flow ioc 5 discord.com 8 discord.com 12 discord.com 13 discord.com 17 discord.com 4 discord.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1" LogonUI.exe -
Suspicious behavior: LoadsDriver 64 IoCs
pid Process 5060 Process not Found 2464 Process not Found 2680 Process not Found 2428 Process not Found 1196 Process not Found 3480 Process not Found 748 Process not Found 4648 Process not Found 916 Process not Found 4404 Process not Found 4992 Process not Found 5012 Process not Found 4660 Process not Found 1116 Process not Found 928 Process not Found 4364 Process not Found 4900 Process not Found 520 Process not Found 4952 Process not Found 3352 Process not Found 2816 Process not Found 1220 Process not Found 1924 Process not Found 4232 Process not Found 3780 Process not Found 5112 Process not Found 5096 Process not Found 2632 Process not Found 2944 Process not Found 2264 Process not Found 3992 Process not Found 4204 Process not Found 4520 Process not Found 4600 Process not Found 4208 Process not Found 1972 Process not Found 2060 Process not Found 1252 Process not Found 2280 Process not Found 4156 Process not Found 1652 Process not Found 372 Process not Found 3832 Process not Found 3864 Process not Found 5084 Process not Found 4632 Process not Found 2832 Process not Found 2116 Process not Found 3908 Process not Found 2000 Process not Found 4092 Process not Found 1492 Process not Found 1276 Process not Found 4196 Process not Found 1488 Process not Found 1012 Process not Found 2664 Process not Found 2668 Process not Found 2684 Process not Found 1556 Process not Found 2028 Process not Found 1964 Process not Found 4244 Process not Found 4240 Process not Found -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4296 newgame.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1540 LogonUI.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4296 wrote to memory of 3336 4296 newgame.exe 73 PID 4296 wrote to memory of 3336 4296 newgame.exe 73
Processes
-
C:\Users\Admin\AppData\Local\Temp\newgame.exe"C:\Users\Admin\AppData\Local\Temp\newgame.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\System32\shutdown.exe"C:\Windows\System32\shutdown.exe" /L2⤵PID:3336
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3aec055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1540