Analysis
- max time kernel
148s - max time network
202s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
30/06/2024, 16:02
Behavioral task
behavioral1
Sample
Easy Installer.exe
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Easy Installer.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target Easy Installer.exe
- Size 78KB
- Sample240630-tgr88azgpf
- SHA256 57eed574304d4cfbcc88500b5182c4860d41d304981fb4998ed86d07988a2ca0
- MD5 47eea4e5c2e7a5c324bdbe8dbd92f767
- SHA1 0ef6fc9907bfde40c891ac4fb2b6edb7a1309666
- SHA512 28b656ca6eb05da8485851812ab9e4ccc88f2fca2c7824584ffcee3387cc521fc5bf41251c76db45a9a2228ec0d63da9d194bd7af515610d0df54e28c77128df
- SSDEEP 1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+SLPIC:5Zv5PDwbjNrmAE+CIC
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTI1Njg3NTU2Mjg4MzA4ODQ2NQ.Gfaomm.Q8t_H-8TPNfmYeYs7TNEUk7uofM9ZANkiepzfY
-
server_id
1256875331898577006
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3376 Easy Installer.exe Token: SeDebugPrivilege 3936 taskmgr.exe Token: SeSystemProfilePrivilege 3936 taskmgr.exe Token: SeCreateGlobalPrivilege 3936 taskmgr.exe Token: 33 3936 taskmgr.exe Token: SeIncBasePriorityPrivilege 3936 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe 3936 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Easy Installer.exe"C:\Users\Admin\AppData\Local\Temp\Easy Installer.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3376
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3936