Malware Analysis Report

2024-09-11 09:06

Sample ID 240626-thephs1hle
Target https://cdn.discordapp.com/attachments/1255165018316476447/1255511838292971550/3CXLoader_.exe?ex=667d6604&is=667c1484&hm=3dfb0e5e516e2709cfc51305ca6edf7d1956e3bcbab56a2d64f29b61a1fd9037&
Tags
discordrat persistence rat rootkit stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

Threat Level: Known bad

The file https://cdn.discordapp.com/attachments/1255165018316476447/1255511838292971550/3CXLoader_.exe?ex=667d6604&is=667c1484&hm=3dfb0e5e516e2709cfc51305ca6edf7d1956e3bcbab56a2d64f29b61a1fd9037& was found to be: Known bad.

Malicious Activity Summary

discordrat persistence rat rootkit stealer

Discord RAT

Executes dropped EXE

Legitimate hosting services abused for malware hosting/C2

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Discovery
TA0007
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Web Service
T1102
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-26 16:03

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-26 16:03

Reported

2024-06-26 16:04

Platform

win10v2004-20240611-en

Max time kernel

52s

Max time network

54s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1255165018316476447/1255511838292971550/3CXLoader_.exe?ex=667d6604&is=667c1484&hm=3dfb0e5e516e2709cfc51305ca6edf7d1956e3bcbab56a2d64f29b61a1fd9037&

Signatures

Discord RAT

stealer rootkit rat persistence discordrat

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\3CXLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\3CXLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX2\3CXLoader.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX3\3CXLoader.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\3CXLoader.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX1\3CXLoader.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX2\3CXLoader.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX3\3CXLoader.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3988 wrote to memory of 4300 N/A C:\Users\Admin\Downloads\3CXLoader.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\3CXLoader.exe
PID 3988 wrote to memory of 4300 N/A C:\Users\Admin\Downloads\3CXLoader.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\3CXLoader.exe
PID 5180 wrote to memory of 5412 N/A C:\Users\Admin\Downloads\3CXLoader.exe C:\Users\Admin\AppData\Local\Temp\RarSFX1\3CXLoader.exe
PID 5180 wrote to memory of 5412 N/A C:\Users\Admin\Downloads\3CXLoader.exe C:\Users\Admin\AppData\Local\Temp\RarSFX1\3CXLoader.exe
PID 5200 wrote to memory of 5488 N/A C:\Users\Admin\Downloads\3CXLoader.exe C:\Users\Admin\AppData\Local\Temp\RarSFX2\3CXLoader.exe
PID 5200 wrote to memory of 5488 N/A C:\Users\Admin\Downloads\3CXLoader.exe C:\Users\Admin\AppData\Local\Temp\RarSFX2\3CXLoader.exe
PID 5372 wrote to memory of 3556 N/A C:\Users\Admin\Downloads\3CXLoader.exe C:\Users\Admin\AppData\Local\Temp\RarSFX3\3CXLoader.exe
PID 5372 wrote to memory of 3556 N/A C:\Users\Admin\Downloads\3CXLoader.exe C:\Users\Admin\AppData\Local\Temp\RarSFX3\3CXLoader.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1255165018316476447/1255511838292971550/3CXLoader_.exe?ex=667d6604&is=667c1484&hm=3dfb0e5e516e2709cfc51305ca6edf7d1956e3bcbab56a2d64f29b61a1fd9037&

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=764,i,7869973516895866428,11647313872437892197,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=4308,i,7869973516895866428,11647313872437892197,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=5072,i,7869973516895866428,11647313872437892197,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5472,i,7869973516895866428,11647313872437892197,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5488,i,7869973516895866428,11647313872437892197,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --field-trial-handle=6308,i,7869973516895866428,11647313872437892197,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --field-trial-handle=5108,i,7869973516895866428,11647313872437892197,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --field-trial-handle=6300,i,7869973516895866428,11647313872437892197,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=5024,i,7869973516895866428,11647313872437892197,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --field-trial-handle=6976,i,7869973516895866428,11647313872437892197,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=7128,i,7869973516895866428,11647313872437892197,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --field-trial-handle=6996,i,7869973516895866428,11647313872437892197,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:8

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x4f0 0x320

C:\Users\Admin\Downloads\3CXLoader.exe

"C:\Users\Admin\Downloads\3CXLoader.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\3CXLoader.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\3CXLoader.exe"

C:\Users\Admin\Downloads\3CXLoader.exe

"C:\Users\Admin\Downloads\3CXLoader.exe"

C:\Users\Admin\Downloads\3CXLoader.exe

"C:\Users\Admin\Downloads\3CXLoader.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX1\3CXLoader.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX1\3CXLoader.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX2\3CXLoader.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX2\3CXLoader.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --field-trial-handle=5320,i,7869973516895866428,11647313872437892197,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\125.0.2535.92\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --field-trial-handle=5320,i,7869973516895866428,11647313872437892197,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --field-trial-handle=6604,i,7869973516895866428,11647313872437892197,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:1

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

C:\Users\Admin\Downloads\3CXLoader.exe

"C:\Users\Admin\Downloads\3CXLoader.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX3\3CXLoader.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX3\3CXLoader.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=7172,i,7869973516895866428,11647313872437892197,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
US 8.8.8.8:53 api.edgeoffer.microsoft.com udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 40.71.99.188:443 api.edgeoffer.microsoft.com tcp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.135.233:443 cdn.discordapp.com udp
US 8.8.8.8:53 business.bing.com udp
US 8.8.8.8:53 business.bing.com udp
US 13.107.6.158:443 business.bing.com tcp
US 8.8.8.8:53 bzib.nelreports.net udp
US 8.8.8.8:53 bzib.nelreports.net udp
NL 2.18.121.23:443 bzib.nelreports.net tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 www.microsoft.com udp
US 23.200.189.225:443 www.microsoft.com tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 233.135.159.162.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 188.99.71.40.in-addr.arpa udp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 23.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 225.189.200.23.in-addr.arpa udp
US 8.8.8.8:53 89.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 nav-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 dl-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 dl-edge.smartscreen.microsoft.com udp
GB 51.140.244.186:443 dl-edge.smartscreen.microsoft.com tcp
GB 172.165.69.228:443 nav-edge.smartscreen.microsoft.com tcp
GB 172.165.69.228:443 nav-edge.smartscreen.microsoft.com tcp
GB 172.165.69.228:443 nav-edge.smartscreen.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
US 8.8.8.8:53 app-edge.smartscreen.microsoft.com udp
US 8.8.8.8:53 app-edge.smartscreen.microsoft.com udp
GB 172.165.61.93:443 app-edge.smartscreen.microsoft.com tcp
US 8.8.8.8:53 c.s-microsoft.com udp
US 8.8.8.8:53 c.s-microsoft.com udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 8.8.8.8:53 edgestatic.azureedge.net udp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 8.8.8.8:53 186.244.140.51.in-addr.arpa udp
US 8.8.8.8:53 228.69.165.172.in-addr.arpa udp
US 8.8.8.8:53 93.61.165.172.in-addr.arpa udp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 13.107.246.64:443 edgestatic.azureedge.net tcp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 8.8.8.8:53 wcpstatic.microsoft.com udp
US 13.107.246.64:443 wcpstatic.microsoft.com tcp
BE 2.17.107.114:443 www.bing.com udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 114.107.17.2.in-addr.arpa udp
BE 88.221.83.209:443 www.bing.com tcp
US 8.8.8.8:53 209.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 gateway.discord.gg udp
US 162.159.130.234:443 gateway.discord.gg tcp
US 8.8.8.8:53 234.130.159.162.in-addr.arpa udp
US 8.8.8.8:53 discord.com udp
US 162.159.137.232:443 discord.com tcp
US 8.8.8.8:53 geolocation-db.com udp
DE 159.89.102.253:443 geolocation-db.com tcp
US 162.159.130.234:443 gateway.discord.gg tcp
US 162.159.130.234:443 gateway.discord.gg tcp
US 8.8.8.8:53 232.137.159.162.in-addr.arpa udp
US 162.159.137.232:443 discord.com tcp
DE 159.89.102.253:443 geolocation-db.com tcp
US 162.159.137.232:443 discord.com tcp
US 162.159.137.232:443 discord.com tcp
US 8.8.8.8:53 253.102.89.159.in-addr.arpa udp
US 162.159.130.234:443 gateway.discord.gg tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 162.159.137.232:443 discord.com tcp
DE 159.89.102.253:443 geolocation-db.com tcp
US 162.159.137.232:443 discord.com tcp
US 8.8.8.8:53 31.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\RarSFX0\3CXLoader.exe

MD5 59c231f52b80f128a8f5ef1216980c82
SHA1 710bfdbca2cc26a856619808121e23160fae874f
SHA256 e8452a2ffae08315c802c2ac4de41ea328de6fed942890e0682d261e89391502
SHA512 93024af146d4586ada9410ba59f49811454fad40bf61349e99c5b4920449d5fcea3c70ba6a7df53b80464d61efcca708c22847f27f02be4ede4b97ce1678c5f1

memory/4300-14-0x000001C3E4760000-0x000001C3E4778000-memory.dmp

memory/4300-15-0x00007FFA2EF53000-0x00007FFA2EF55000-memory.dmp

memory/4300-16-0x000001C3FEDA0000-0x000001C3FEF62000-memory.dmp

memory/4300-17-0x00007FFA2EF50000-0x00007FFA2FA11000-memory.dmp

memory/4300-18-0x000001C380530000-0x000001C380A58000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX2\3CX.jpg

MD5 a966b0d8ea9adb1b32f8cda40dec4d32
SHA1 98d342253bbe84c20a03742e409e0c3909ae28dd
SHA256 e1e993f2026f740af27642e9b0529a8eee5614829fd89e9e715c0e4f5aeec680
SHA512 6878b1fba8f72e82ab6d3d6821eee7493a0c16c64f46505bf4069314d4550791b6f94e73f15737a95f8f04e4d07f020b6c7ec306b218f84ba6fded0bfb3074bd

memory/4300-47-0x00007FFA2EF53000-0x00007FFA2EF55000-memory.dmp

memory/4300-48-0x00007FFA2EF50000-0x00007FFA2FA11000-memory.dmp