Analysis
-
max time kernel
31s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
25-06-2024 00:19
Behavioral task
behavioral1
Sample
yjnclient-v3.exe
Resource
win7-20240220-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
yjnclient-v3.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
yjnclient-v3.exe
-
Size
78KB
-
MD5
f758d08d23a5ddf8905d5c17084abf07
-
SHA1
b237a04b0ab5374f41ec90186d1de0250569a82d
-
SHA256
6624c79c2c07fbcb8d4244fadd4e16ad4c536c187c25acaf3b831fff7cbda3c9
-
SHA512
7fd582bb2c319d1cd43efa1d01420f2e58378c15542c044b2450da0da0112a55ae98afd52e851da767d487456927556152d3925ef11194c35bb25bcc9b7f747f
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+BAPIC:5Zv5PDwbjNrmAE+OIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI1NDkyMzczMDE3ODY3NDgwMw.GNKnH3._2hi153EQeLcF4SWSwr0pQuzH__TVonJih1mFM
-
server_id
1254923576340119644
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2580 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2580 taskmgr.exe -
Suspicious use of FindShellTrayWindow 40 IoCs
pid Process 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe -
Suspicious use of SendNotifyMessage 39 IoCs
pid Process 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe 2580 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1992 wrote to memory of 2860 1992 yjnclient-v3.exe 28 PID 1992 wrote to memory of 2860 1992 yjnclient-v3.exe 28 PID 1992 wrote to memory of 2860 1992 yjnclient-v3.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\yjnclient-v3.exe"C:\Users\Admin\AppData\Local\Temp\yjnclient-v3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1992 -s 6002⤵PID:2860
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2580