Analysis
-
max time kernel
62s -
max time network
65s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 22:11
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
7 signatures
300 seconds
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
7c61b3180ba4cac4c22f9a1db40be7d7
-
SHA1
977ca2e82b1371138fe54ae53b254e98641cd5f5
-
SHA256
f2fb9c24518a9e85db1c28ab2c47a513c4764c2d55e596395fab7e2031ed973e
-
SHA512
f698bd22bf4f78a0724557f94af769d488ece60cf22df5a8dde5d1ed0c0d879e0eaa3c978b4109163c8835929610c61dc4fa082fb1a4567c74d07bd693b79df7
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+VPIC:5Zv5PDwbjNrmAE+FIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI1NjM2MzA4MzE5NTA4OTA1OQ.GGag1Q.GsRKtE4Q53MlpflZVGE7Eyl1pC8pjQcV3hG2Oo
-
server_id
1020984986041593866
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 45 IoCs
pid Process 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2468 Client-built.exe Token: SeDebugPrivilege 1456 taskmgr.exe Token: SeSystemProfilePrivilege 1456 taskmgr.exe Token: SeCreateGlobalPrivilege 1456 taskmgr.exe -
Suspicious use of FindShellTrayWindow 56 IoCs
pid Process 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe -
Suspicious use of SendNotifyMessage 56 IoCs
pid Process 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe 1456 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2468
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1456
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:212