Resubmissions
03-07-2024 18:28
240703-w4qd9asblp 1003-07-2024 17:34
240703-v5gcaszfrn 1003-07-2024 17:28
240703-v1z9lszenm 10Analysis
-
max time kernel
88s -
max time network
82s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03-07-2024 18:28
Behavioral task
behavioral1
Sample
release.zip
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
release.zip
-
Size
445KB
-
MD5
06a4fcd5eb3a39d7f50a0709de9900db
-
SHA1
50d089e915f69313a5187569cda4e6dec2d55ca7
-
SHA256
c13a0cd7c2c2fd577703bff026b72ed81b51266afa047328c8ff1c4a4d965c97
-
SHA512
75e5f637fd3282d088b1c0c1efd0de8a128f681e4ac66d6303d205471fe68b4fbf0356a21d803aff2cca6def455abad8619fedc8c7d51e574640eda0df561f9b
-
SSDEEP
12288:BfJ13+GoLo2d5ifXHE8134QwYOwFSFRiLQI:BKGo8EifSQwYWI
Score
10/10
Malware Config
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Executes dropped EXE 1 IoCs
pid Process 4332 Client-built.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 55 IoCs
pid Process 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3192 taskmgr.exe Token: SeSystemProfilePrivilege 3192 taskmgr.exe Token: SeCreateGlobalPrivilege 3192 taskmgr.exe Token: SeDebugPrivilege 4472 Discord rat.exe Token: SeDebugPrivilege 2680 Discord rat.exe Token: SeDebugPrivilege 4332 Client-built.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe 3192 taskmgr.exe
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\release.zip1⤵PID:4424
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3124
-
C:\Users\Admin\Desktop\release\builder.exe"C:\Users\Admin\Desktop\release\builder.exe"1⤵PID:3872
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3192
-
C:\Users\Admin\Desktop\release\Release\Discord rat.exe"C:\Users\Admin\Desktop\release\Release\Discord rat.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4472
-
C:\Users\Admin\Desktop\release\Release\Discord rat.exe"C:\Users\Admin\Desktop\release\Release\Discord rat.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2680
-
C:\Users\Admin\Desktop\release\Client-built.exe"C:\Users\Admin\Desktop\release\Client-built.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4332
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD53cb5e3e667e59e47c079ae2e68a18712
SHA11355a321705c340532e0689c89399c2fd279fe33
SHA2567e73c5bafa376c3aa28fb922519ba798112717197e2e54ba1dc19e4617867d1d
SHA512cf6620155a74ec4e2dcdd111fd71fb8277c626f26f1ffe9f200a54d0a55c9ebf321eee6de14d9cebb5317ecaed367ddc6f1aff5bbdec52a737e4c22dfd5406ce