Analysis
-
max time kernel
148s -
max time network
202s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2024 16:02
Behavioral task
behavioral1
Sample
Easy Installer.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Easy Installer.exe
Resource
win10v2004-20240611-en
General
-
Target
Easy Installer.exe
-
Size
78KB
-
MD5
47eea4e5c2e7a5c324bdbe8dbd92f767
-
SHA1
0ef6fc9907bfde40c891ac4fb2b6edb7a1309666
-
SHA256
57eed574304d4cfbcc88500b5182c4860d41d304981fb4998ed86d07988a2ca0
-
SHA512
28b656ca6eb05da8485851812ab9e4ccc88f2fca2c7824584ffcee3387cc521fc5bf41251c76db45a9a2228ec0d63da9d194bd7af515610d0df54e28c77128df
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+SLPIC:5Zv5PDwbjNrmAE+CIC
Malware Config
Extracted
discordrat
-
discord_token
MTI1Njg3NTU2Mjg4MzA4ODQ2NQ.Gfaomm.Q8t_H-8TPNfmYeYs7TNEUk7uofM9ZANkiepzfY
-
server_id
1256875331898577006
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exepid process 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
Easy Installer.exetaskmgr.exedescription pid process Token: SeDebugPrivilege 3376 Easy Installer.exe Token: SeDebugPrivilege 3936 taskmgr.exe Token: SeSystemProfilePrivilege 3936 taskmgr.exe Token: SeCreateGlobalPrivilege 3936 taskmgr.exe Token: 33 3936 taskmgr.exe Token: SeIncBasePriorityPrivilege 3936 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Easy Installer.exe"C:\Users\Admin\AppData\Local\Temp\Easy Installer.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3376-1-0x000002759FA20000-0x000002759FA38000-memory.dmpFilesize
96KB
-
memory/3376-0-0x00007FFC51413000-0x00007FFC51415000-memory.dmpFilesize
8KB
-
memory/3376-2-0x00000275BA140000-0x00000275BA302000-memory.dmpFilesize
1.8MB
-
memory/3376-3-0x00007FFC51410000-0x00007FFC51ED1000-memory.dmpFilesize
10.8MB
-
memory/3376-4-0x00000275BA940000-0x00000275BAE68000-memory.dmpFilesize
5.2MB
-
memory/3376-18-0x00007FFC51410000-0x00007FFC51ED1000-memory.dmpFilesize
10.8MB
-
memory/3936-17-0x000001CC35710000-0x000001CC35711000-memory.dmpFilesize
4KB
-
memory/3936-6-0x000001CC35710000-0x000001CC35711000-memory.dmpFilesize
4KB
-
memory/3936-7-0x000001CC35710000-0x000001CC35711000-memory.dmpFilesize
4KB
-
memory/3936-16-0x000001CC35710000-0x000001CC35711000-memory.dmpFilesize
4KB
-
memory/3936-15-0x000001CC35710000-0x000001CC35711000-memory.dmpFilesize
4KB
-
memory/3936-14-0x000001CC35710000-0x000001CC35711000-memory.dmpFilesize
4KB
-
memory/3936-13-0x000001CC35710000-0x000001CC35711000-memory.dmpFilesize
4KB
-
memory/3936-12-0x000001CC35710000-0x000001CC35711000-memory.dmpFilesize
4KB
-
memory/3936-11-0x000001CC35710000-0x000001CC35711000-memory.dmpFilesize
4KB
-
memory/3936-5-0x000001CC35710000-0x000001CC35711000-memory.dmpFilesize
4KB