Analysis
-
max time kernel
53s -
max time network
43s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
12-06-2024 07:48
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win10-20240404-en
windows10-1703-x64
7 signatures
150 seconds
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
7c20e0c92b9a3ddb0b0c97e5b519c5bd
-
SHA1
70a6c31edaeb7e6f4bf72cb0cdfb8da8a0ffe9e0
-
SHA256
2156d6f172acbc05fc59ce50ca13c6c676a084c63246d48f5c3ff96497c8d10d
-
SHA512
defd172cf8f0df491df51ebf7bd46a717d6ce6ad54f4e7235704a022b6dba110782e09f8d82e15649ee2ea7d9c3d34076eb114b58b6c071eba730832c1856a45
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+oPIC:5Zv5PDwbjNrmAE+sIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI0NTQ1NjE5NTk2MDA0NTU4OQ.G-cE5Y.Jrz_bFmc_kkw6BRByxqyLwYoBCknjrUGADfFGU
-
server_id
1245410495406674023
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4360 Client-built.exe Token: SeDebugPrivilege 3580 taskmgr.exe Token: SeSystemProfilePrivilege 3580 taskmgr.exe Token: SeCreateGlobalPrivilege 3580 taskmgr.exe Token: 33 3580 taskmgr.exe Token: SeIncBasePriorityPrivilege 3580 taskmgr.exe -
Suspicious use of FindShellTrayWindow 55 IoCs
pid Process 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe -
Suspicious use of SendNotifyMessage 54 IoCs
pid Process 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4360
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3580