Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows11-21h2_x64 -
resource
win11-20240611-en -
resource tags
arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system -
submitted
25-06-2024 14:30
Behavioral task
behavioral1
Sample
cdumper/compiler.exe
Resource
win11-20240611-en
Behavioral task
behavioral2
Sample
cdumper/setup.bat
Resource
win11-20240508-en
General
-
Target
cdumper/compiler.exe
-
Size
78KB
-
MD5
cc0c0d53ea855321b892e9d69ce09d1f
-
SHA1
604de3c919a7768f107e15c12c816ed11ea0146f
-
SHA256
cd28a30e4e7970b5fe7e2d2ab0244a41ed3fed048904d671ce2db28de1a87529
-
SHA512
58a7a3e9b374296d8898929a9c1806beb501e45c232efd11db1449583e8227b4a0511fc724d07be030baa640aa285ed7648ed1a328a40e47989b0d7673a4d609
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+SPIC:5Zv5PDwbjNrmAE+eIC
Malware Config
Extracted
discordrat
-
discord_token
MTI1MzY2NzkzMTcwMzc0MjQ3NA.Gw8dsn.LeG778rjIzDyfb3CK-K3udb1GPBgWlxFwh_VdU
-
server_id
1250682422434074634
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 15 IoCs
Processes:
LogonUI.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "217" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe -
Suspicious behavior: LoadsDriver 64 IoCs
Processes:
pid process 1548 3136 1876 3328 4100 4504 2532 1276 572 4736 1916 1336 3040 3836 3560 3752 2492 4772 756 912 2760 4700 1552 708 1764 2284 1300 5076 2776 2836 1340 1572 1580 5036 1612 4664 1784 1312 4844 3120 5084 2960 752 1932 2416 4900 900 2820 3652 2024 3780 3360 3688 3588 3144 976 3076 4524 2896 4644 2080 3792 4896 2636 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
compiler.exedescription pid process Token: SeDebugPrivilege 4256 compiler.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
LogonUI.exepid process 1080 LogonUI.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
compiler.exedescription pid process target process PID 4256 wrote to memory of 3912 4256 compiler.exe shutdown.exe PID 4256 wrote to memory of 3912 4256 compiler.exe shutdown.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdumper\compiler.exe"C:\Users\Admin\AppData\Local\Temp\cdumper\compiler.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\shutdown.exe"C:\Windows\System32\shutdown.exe" /L2⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a08055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4256-0-0x00000204F7DE0000-0x00000204F7DF8000-memory.dmpFilesize
96KB
-
memory/4256-1-0x00007FFEBD033000-0x00007FFEBD035000-memory.dmpFilesize
8KB
-
memory/4256-2-0x00000204FA410000-0x00000204FA5D2000-memory.dmpFilesize
1.8MB
-
memory/4256-3-0x00007FFEBD030000-0x00007FFEBDAF2000-memory.dmpFilesize
10.8MB
-
memory/4256-4-0x00000204FB690000-0x00000204FBBB8000-memory.dmpFilesize
5.2MB
-
memory/4256-5-0x00007FFEBD030000-0x00007FFEBDAF2000-memory.dmpFilesize
10.8MB