discordrat | aca13de69b970f10357414fc04b9d424e3ec91d46c48dcf23244309e6994de24

Resubmissions

03-07-2024 23:05

240703-2267waselb 10

03-07-2024 22:33

240703-2gstra1dne 10

Analysis

max time kernel
95s
max time network
97s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
03-07-2024 22:33

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

HackerTool.exe
Size

78KB
MD5

700cbe7842075702ba7a814135377cba
SHA1

afc4dae81fdcd51e6cfba4df93b95473019db51d
SHA256

aca13de69b970f10357414fc04b9d424e3ec91d46c48dcf23244309e6994de24
SHA512

1a364f96ee78c3e83ec4a9e9a88d070a67fa55cbc4f3e2e5a99f2c4f5d933abee9f98f5537d56159a57771d82e78a19a1b14e1a52002d2420783cfafde59de11
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+LPIC:5Zv5PDwbjNrmAE+jIC

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI1Nzk1NzI4ODU0MzUyMjk0OA.GIpluZ.fDKYKipS9PVq4yhIAizQmTyDwK5kQQ8ux_PrHQ
server_id
1257954812113190942

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

1 discord.com
3 discord.com
6 discord.com

flow	ioc
1	discord.com
3	discord.com
6	discord.com

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "5"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

HackerTool.exe

description pid process

Token: SeDebugPrivilege 4604 HackerTool.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid process

4264 LogonUI.exe

description	pid	process
Token: SeDebugPrivilege	4604	HackerTool.exe

pid	process
4264	LogonUI.exe

C:\Users\Admin\AppData\Local\Temp\HackerTool.exe
"C:\Users\Admin\AppData\Local\Temp\HackerTool.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4604

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a1a055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4604-0-0x000001DDC7D90000-0x000001DDC7DA8000-memory.dmp

Filesize
96KB

Download
memory/4604-1-0x00007FFC0E963000-0x00007FFC0E965000-memory.dmp

Filesize
8KB

Download
memory/4604-2-0x000001DDE23F0000-0x000001DDE25B2000-memory.dmp

Filesize
1.8MB

Download
memory/4604-3-0x00007FFC0E960000-0x00007FFC0F422000-memory.dmp

Filesize
10.8MB

Download
memory/4604-4-0x000001DDE3670000-0x000001DDE3B98000-memory.dmp

Filesize
5.2MB

Download
memory/4604-5-0x00007FFC0E960000-0x00007FFC0F422000-memory.dmp

Filesize
10.8MB

Download
memory/4604-7-0x00007FFC0E960000-0x00007FFC0F422000-memory.dmp

Filesize
10.8MB

Download