Analysis
-
max time kernel
128s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-06-2024 17:58
Behavioral task
behavioral1
Sample
Coreblocks_installer.exe
Resource
win7-20240611-en
windows7-x64
2 signatures
1800 seconds
Behavioral task
behavioral2
Sample
Coreblocks_installer.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
7 signatures
1800 seconds
General
-
Target
Coreblocks_installer.exe
-
Size
79KB
-
MD5
d13905e018eb965ded2e28ba0ab257b5
-
SHA1
6d7fe69566fddc69b33d698591c9a2c70d834858
-
SHA256
2bd631c6665656673a923c13359b0dc211debc05b2885127e26b0dce808e2dec
-
SHA512
b95bfdebef33ac72b6c21cdf0abb4961222b7efd17267cd7236e731dd0b6105ece28e784a95455f1ffc8a6dd1d580a467b07b3bd8cb2fb19e2111f1a864c97cb
-
SSDEEP
1536:YCH0jBD2BKkwbPNrfxCXhRoKV6+V+y9viwp:VUjBD2BPwbPNrmAE+MqU
Score
10/10
Malware Config
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3692 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 224 Coreblocks_installer.exe Token: SeDebugPrivilege 3692 taskmgr.exe Token: SeSystemProfilePrivilege 3692 taskmgr.exe Token: SeCreateGlobalPrivilege 3692 taskmgr.exe Token: 33 3692 taskmgr.exe Token: SeIncBasePriorityPrivilege 3692 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe 3692 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Coreblocks_installer.exe"C:\Users\Admin\AppData\Local\Temp\Coreblocks_installer.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:224
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4404,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:81⤵PID:3996
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3692