Analysis
-
max time kernel
125s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03-07-2024 14:33
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240419-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Client-built.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
e3da42e9e01ad24577063f29b9597c27
-
SHA1
3b89bd0e40d24560dd20a5903a85a1c75d880f36
-
SHA256
1e0c721048a8d89b49dacb25273fe6b902c73eb5d65de8b048e48a0e0427e6ea
-
SHA512
49752139c123b48d0b1a603da53aaba60441f0229768311f1f6aaf73d2836fa544aea27e4274bdff94dc64ae5dc25cbe86fd46cc705ae5e14ccdc441e94eefbd
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+/qPIC:5Zv5PDwbjNrmAE+/2IC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTE3NjU2MzUzMzgyODMzMzY3OA.GKIWtV.HP2J8C6vd83uEFDiGrZHycVQwFem2yf4mmx8x8
-
server_id
1246589579444621433
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 2364 Client-built.exe Token: SeDebugPrivilege 1468 taskmgr.exe Token: SeSystemProfilePrivilege 1468 taskmgr.exe Token: SeCreateGlobalPrivilege 1468 taskmgr.exe Token: SeSecurityPrivilege 1468 taskmgr.exe Token: SeTakeOwnershipPrivilege 1468 taskmgr.exe Token: 33 1468 taskmgr.exe Token: SeIncBasePriorityPrivilege 1468 taskmgr.exe -
Suspicious use of FindShellTrayWindow 60 IoCs
pid Process 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe -
Suspicious use of SendNotifyMessage 59 IoCs
pid Process 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe 1468 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2364
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4256,i,18168883380598738769,14202261231630113808,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:81⤵PID:4008
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1468
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1592