Analysis
-
max time kernel
1799s -
max time network
1691s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/07/2024, 13:37
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/moom825/Discord-RAT-2.0/archive/refs/heads/master.zip
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
1800 seconds
General
-
Target
https://github.com/moom825/Discord-RAT-2.0/archive/refs/heads/master.zip
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133644875458245263" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3212 chrome.exe 3212 chrome.exe 2484 chrome.exe 2484 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3212 chrome.exe 3212 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe Token: SeShutdownPrivilege 3212 chrome.exe Token: SeCreatePagefilePrivilege 3212 chrome.exe -
Suspicious use of FindShellTrayWindow 44 IoCs
pid Process 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe 3212 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3212 wrote to memory of 2748 3212 chrome.exe 81 PID 3212 wrote to memory of 2748 3212 chrome.exe 81 PID 3212 wrote to memory of 4428 3212 chrome.exe 82 PID 3212 wrote to memory of 4428 3212 chrome.exe 82 PID 3212 wrote to memory of 4428 3212 chrome.exe 82 PID 3212 wrote to memory of 4428 3212 chrome.exe 82 PID 3212 wrote to memory of 4428 3212 chrome.exe 82 PID 3212 wrote to memory of 4428 3212 chrome.exe 82 PID 3212 wrote to memory of 4428 3212 chrome.exe 82 PID 3212 wrote to memory of 4428 3212 chrome.exe 82 PID 3212 wrote to memory of 4428 3212 chrome.exe 82 PID 3212 wrote to memory of 4428 3212 chrome.exe 82 PID 3212 wrote to memory of 4428 3212 chrome.exe 82 PID 3212 wrote to memory of 4428 3212 chrome.exe 82 PID 3212 wrote to memory of 4428 3212 chrome.exe 82 PID 3212 wrote to memory of 4428 3212 chrome.exe 82 PID 3212 wrote to memory of 4428 3212 chrome.exe 82 PID 3212 wrote to memory of 4428 3212 chrome.exe 82 PID 3212 wrote to memory of 4428 3212 chrome.exe 82 PID 3212 wrote to memory of 4428 3212 chrome.exe 82 PID 3212 wrote to memory of 4428 3212 chrome.exe 82 PID 3212 wrote to memory of 4428 3212 chrome.exe 82 PID 3212 wrote to memory of 4428 3212 chrome.exe 82 PID 3212 wrote to memory of 4428 3212 chrome.exe 82 PID 3212 wrote to memory of 4428 3212 chrome.exe 82 PID 3212 wrote to memory of 4428 3212 chrome.exe 82 PID 3212 wrote to memory of 4428 3212 chrome.exe 82 PID 3212 wrote to memory of 4428 3212 chrome.exe 82 PID 3212 wrote to memory of 4428 3212 chrome.exe 82 PID 3212 wrote to memory of 4428 3212 chrome.exe 82 PID 3212 wrote to memory of 4428 3212 chrome.exe 82 PID 3212 wrote to memory of 4428 3212 chrome.exe 82 PID 3212 wrote to memory of 4428 3212 chrome.exe 82 PID 3212 wrote to memory of 3124 3212 chrome.exe 83 PID 3212 wrote to memory of 3124 3212 chrome.exe 83 PID 3212 wrote to memory of 3664 3212 chrome.exe 84 PID 3212 wrote to memory of 3664 3212 chrome.exe 84 PID 3212 wrote to memory of 3664 3212 chrome.exe 84 PID 3212 wrote to memory of 3664 3212 chrome.exe 84 PID 3212 wrote to memory of 3664 3212 chrome.exe 84 PID 3212 wrote to memory of 3664 3212 chrome.exe 84 PID 3212 wrote to memory of 3664 3212 chrome.exe 84 PID 3212 wrote to memory of 3664 3212 chrome.exe 84 PID 3212 wrote to memory of 3664 3212 chrome.exe 84 PID 3212 wrote to memory of 3664 3212 chrome.exe 84 PID 3212 wrote to memory of 3664 3212 chrome.exe 84 PID 3212 wrote to memory of 3664 3212 chrome.exe 84 PID 3212 wrote to memory of 3664 3212 chrome.exe 84 PID 3212 wrote to memory of 3664 3212 chrome.exe 84 PID 3212 wrote to memory of 3664 3212 chrome.exe 84 PID 3212 wrote to memory of 3664 3212 chrome.exe 84 PID 3212 wrote to memory of 3664 3212 chrome.exe 84 PID 3212 wrote to memory of 3664 3212 chrome.exe 84 PID 3212 wrote to memory of 3664 3212 chrome.exe 84 PID 3212 wrote to memory of 3664 3212 chrome.exe 84 PID 3212 wrote to memory of 3664 3212 chrome.exe 84 PID 3212 wrote to memory of 3664 3212 chrome.exe 84 PID 3212 wrote to memory of 3664 3212 chrome.exe 84 PID 3212 wrote to memory of 3664 3212 chrome.exe 84 PID 3212 wrote to memory of 3664 3212 chrome.exe 84 PID 3212 wrote to memory of 3664 3212 chrome.exe 84 PID 3212 wrote to memory of 3664 3212 chrome.exe 84 PID 3212 wrote to memory of 3664 3212 chrome.exe 84 PID 3212 wrote to memory of 3664 3212 chrome.exe 84
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/moom825/Discord-RAT-2.0/archive/refs/heads/master.zip1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff86b2ab58,0x7fff86b2ab68,0x7fff86b2ab782⤵PID:2748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1588 --field-trial-handle=1932,i,15471459780415007209,13169883446178941621,131072 /prefetch:22⤵PID:4428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1932,i,15471459780415007209,13169883446178941621,131072 /prefetch:82⤵PID:3124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2232 --field-trial-handle=1932,i,15471459780415007209,13169883446178941621,131072 /prefetch:82⤵PID:3664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3012 --field-trial-handle=1932,i,15471459780415007209,13169883446178941621,131072 /prefetch:12⤵PID:524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3020 --field-trial-handle=1932,i,15471459780415007209,13169883446178941621,131072 /prefetch:12⤵PID:3404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4704 --field-trial-handle=1932,i,15471459780415007209,13169883446178941621,131072 /prefetch:82⤵PID:1660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4872 --field-trial-handle=1932,i,15471459780415007209,13169883446178941621,131072 /prefetch:82⤵PID:2960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3980 --field-trial-handle=1932,i,15471459780415007209,13169883446178941621,131072 /prefetch:82⤵PID:3012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1540 --field-trial-handle=1932,i,15471459780415007209,13169883446178941621,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2484
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:624
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD56ec1553fe83be2c82218830a2e975d7d
SHA122c8ccd11f3dea21ba92d282fe97e83a4986bbaf
SHA256fe9002664139dd6f8c4de52baab3fb5c726bf70ab858aa6e6ec162e5d82cf764
SHA5126ccbbe8e983dbef4d38106324113b8ac422340626d08357fcd0305180f83464adab0486ddb5769fa3fb11e6f3411f9a4c7dc554b4866c66f86e1751456953694
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
691B
MD5560e311a11255203683d58e86d9034bd
SHA124648db48e7039345cc7a342e6940aa2d18ad33f
SHA256e4471a6799ce955988edc1e8fbeb2006b8f15f14cf402f186cf754fe08a33163
SHA512b289fd1150cb996db4bffa8f801003df9a919420861870e01d6c3801a2b15e7d9c89d015d51b1ba1a4b1571bd30740ac79fb8fc2014de08f8a5086fe35d967e9
-
Filesize
7KB
MD5fe25fe93674381c644bfd1b560c690bd
SHA17c423be7b2920ce1a20384dcaf7cee0475c9a01a
SHA256b10f267379baea422a9cbbfaf8ce34eb30e13f03bf0fd49fe39700978ce58863
SHA5124787676bec66ccee5778c038a1180570ad3f22bb249477e2af83251760ef3344c7926c94049c8f898686ed865b538796f23c9f34552379f45e6b0702c9097b2f
-
Filesize
129KB
MD5b6d79325ae2c483da800270d17c6bdc2
SHA1ff3a7e41e19625137e7a0d2607113271c85689e9
SHA256e928020b325be43a7261891b6a62fe6e6dd77dc2dff9a39db17b9c5244515012
SHA5129ea4aa600156555c1d8b4cda6d2aa6da06484106ffc755b6847969a781be70cd3f57d386ef60f5b0b66ad1b2bdbc1219df399a5cd23774d1f11b245a48e465e9