Analysis
-
max time kernel
53s -
max time network
43s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
12-06-2024 07:48
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win10-20240404-en
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
7c20e0c92b9a3ddb0b0c97e5b519c5bd
-
SHA1
70a6c31edaeb7e6f4bf72cb0cdfb8da8a0ffe9e0
-
SHA256
2156d6f172acbc05fc59ce50ca13c6c676a084c63246d48f5c3ff96497c8d10d
-
SHA512
defd172cf8f0df491df51ebf7bd46a717d6ce6ad54f4e7235704a022b6dba110782e09f8d82e15649ee2ea7d9c3d34076eb114b58b6c071eba730832c1856a45
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+oPIC:5Zv5PDwbjNrmAE+sIC
Malware Config
Extracted
discordrat
-
discord_token
MTI0NTQ1NjE5NTk2MDA0NTU4OQ.G-cE5Y.Jrz_bFmc_kkw6BRByxqyLwYoBCknjrUGADfFGU
-
server_id
1245410495406674023
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Drops file in Windows directory 2 IoCs
Processes:
taskmgr.exedescription ioc process File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
taskmgr.exepid process 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
Client-built.exetaskmgr.exedescription pid process Token: SeDebugPrivilege 4360 Client-built.exe Token: SeDebugPrivilege 3580 taskmgr.exe Token: SeSystemProfilePrivilege 3580 taskmgr.exe Token: SeCreateGlobalPrivilege 3580 taskmgr.exe Token: 33 3580 taskmgr.exe Token: SeIncBasePriorityPrivilege 3580 taskmgr.exe -
Suspicious use of FindShellTrayWindow 55 IoCs
Processes:
taskmgr.exepid process 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe -
Suspicious use of SendNotifyMessage 54 IoCs
Processes:
taskmgr.exepid process 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe 3580 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4360-1-0x00007FFA675E3000-0x00007FFA675E4000-memory.dmpFilesize
4KB
-
memory/4360-0-0x000002A9E03E0000-0x000002A9E03F8000-memory.dmpFilesize
96KB
-
memory/4360-2-0x000002A9FA9C0000-0x000002A9FAB82000-memory.dmpFilesize
1.8MB
-
memory/4360-3-0x00007FFA675E0000-0x00007FFA67FCC000-memory.dmpFilesize
9.9MB
-
memory/4360-4-0x000002A9FB2F0000-0x000002A9FB816000-memory.dmpFilesize
5.1MB
-
memory/4360-5-0x00007FFA675E0000-0x00007FFA67FCC000-memory.dmpFilesize
9.9MB