discordrat | 8fe2c7bdf8198ffe699d528d6f59ac9400b9cbbb239c83652796690637dda4b7

Resubmissions

11-06-2024 19:21

240611-x2ytaaycjl 10

11-06-2024 19:20

240611-x17d2ayarf 10

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

40907421415227a30c883fd57a7b4fe4
SHA1

912da0188ac70f09a42bd7933702966cd13c3006
SHA256

8fe2c7bdf8198ffe699d528d6f59ac9400b9cbbb239c83652796690637dda4b7
SHA512

7b4bca177fa7029a5c77144e442840e0bccfe85be85cb4b0623c25b08aaa1e090413192ff0183fc313e0ca03f7420d66860dfbed5728802d1ac0206a8f7c9666
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+APIC:5Zv5PDwbjNrmAE+kIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI0NzU2MDQxNjM0Nzk1MTEyNA.GtsxfD.DgWuDtTP5_alrH-e1pb51ojdXlaPF6goQ2izm0
server_id
1247937473548648579

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
7	discord.com
8	discord.com
17	discord.com

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4756	Client-built.exe
Token: SeDebugPrivilege	224	firefox.exe
Token: SeDebugPrivilege	224	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
224	firefox.exe
224	firefox.exe
224	firefox.exe
224	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
224	firefox.exe
224	firefox.exe
224	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
224	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 224	3128	firefox.exe	90
PID 3128 wrote to memory of 224	3128	firefox.exe	90
PID 3128 wrote to memory of 224	3128	firefox.exe	90
PID 3128 wrote to memory of 224	3128	firefox.exe	90
PID 3128 wrote to memory of 224	3128	firefox.exe	90
PID 3128 wrote to memory of 224	3128	firefox.exe	90
PID 3128 wrote to memory of 224	3128	firefox.exe	90
PID 3128 wrote to memory of 224	3128	firefox.exe	90
PID 3128 wrote to memory of 224	3128	firefox.exe	90
PID 3128 wrote to memory of 224	3128	firefox.exe	90
PID 3128 wrote to memory of 224	3128	firefox.exe	90
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 2992	224	firefox.exe	91
PID 224 wrote to memory of 3164	224	firefox.exe	92
PID 224 wrote to memory of 3164	224	firefox.exe	92
PID 224 wrote to memory of 3164	224	firefox.exe	92
PID 224 wrote to memory of 3164	224	firefox.exe	92
PID 224 wrote to memory of 3164	224	firefox.exe	92
PID 224 wrote to memory of 3164	224	firefox.exe	92
PID 224 wrote to memory of 3164	224	firefox.exe	92
PID 224 wrote to memory of 3164	224	firefox.exe	92
PID 224 wrote to memory of 3164	224	firefox.exe	92
PID 224 wrote to memory of 3164	224	firefox.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4756

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="224.0.473266513\452574821" -parentBuildID 20230214051806 -prefsHandle 1760 -prefMapHandle 1752 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a155b76-7b6a-458a-818c-e0bf1a6ef9cf} 224 "\\.\pipe\gecko-crash-server-pipe.224" 1852 22103a0ff58 gpu
    3⤵
    PID:2992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="224.1.1329227464\1451653353" -parentBuildID 20230214051806 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 22112 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {301e4d5e-196f-4af0-8ed5-c6c0ed300564} 224 "\\.\pipe\gecko-crash-server-pipe.224" 2420 22103f79b58 socket
    3⤵
    PID:3164
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="224.2.229434667\1924265790" -childID 1 -isForBrowser -prefsHandle 3008 -prefMapHandle 3004 -prefsLen 22150 -prefMapSize 235121 -jsInitHandle 1204 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8ea4eb0b-8dcf-4449-8813-117c6df37808} 224 "\\.\pipe\gecko-crash-server-pipe.224" 2848 2210690bc58 tab
    3⤵
    PID:3332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="224.3.1403409763\724762833" -childID 2 -isForBrowser -prefsHandle 3688 -prefMapHandle 3672 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1204 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c7c3666a-ca1d-42b9-b4a0-0d7084b4f872} 224 "\\.\pipe\gecko-crash-server-pipe.224" 3332 22108b69558 tab
    3⤵
    PID:2736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="224.4.1886639612\771462532" -childID 3 -isForBrowser -prefsHandle 5260 -prefMapHandle 5256 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1204 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {db37b1e8-496f-477d-8fd5-280e44f7cf56} 224 "\\.\pipe\gecko-crash-server-pipe.224" 5264 221086fd658 tab
    3⤵
    PID:5112
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="224.5.1912792205\1072426679" -childID 4 -isForBrowser -prefsHandle 5484 -prefMapHandle 5480 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1204 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {27acec6d-2053-44bc-956b-cbf409264007} 224 "\\.\pipe\gecko-crash-server-pipe.224" 5492 221086fdc58 tab
    3⤵
    PID:1436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="224.6.1928796574\598267265" -childID 5 -isForBrowser -prefsHandle 5688 -prefMapHandle 5684 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1204 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0336f053-6db3-4abb-bd8d-28f3137618cb} 224 "\\.\pipe\gecko-crash-server-pipe.224" 5696 221086feb58 tab
    3⤵
    PID:524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="224.7.1233766120\1153290894" -childID 6 -isForBrowser -prefsHandle 6072 -prefMapHandle 6076 -prefsLen 31087 -prefMapSize 235121 -jsInitHandle 1204 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d141446-c1e9-410c-97d8-1db0cb0f14e0} 224 "\\.\pipe\gecko-crash-server-pipe.224" 6104 22112d2d658 tab
    3⤵
    PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control