Analysis
-
max time kernel
175s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
03-07-2024 19:27
Errors
Reason
Machine shutdown
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
702e3d2fe467271a3e3f892bfe309cc4
-
SHA1
48694b9e4bd02a1e7c0c68b09cfa3952913f6113
-
SHA256
bb5c3700d7aed3cf8da3e655577f36bd8662566312488cf85035bd310c50f6cb
-
SHA512
0e9e3f0ec6cfe3cff8bbff5dda0ffcf562cfce804552a16e2f2e2ae3897d9c793256ee9196cff4282c467f5ab6758095f69a3dd293a3608f8665968efe49f6ed
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+rPIC:5Zv5PDwbjNrmAE+DIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI0NzYyMjc1MDMwNzA5NDYwOQ.G75kCj.oUUW-eN7iy9fOSU_z7eZ2sZU33L8Wqa1p6jziw
-
server_id
1247622541909164062
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
Downloads MZ/PE file
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 24 IoCs
-
Drops file in System32 directory 15 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 29 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 15 IoCs
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{797017d6-8b99-4940-b3a1-866caff4c69f}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /72⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks SCSI registry key(s)
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/336-29-0x00007FF827C70000-0x00007FF827C80000-memory.dmpFilesize
64KB
-
memory/336-28-0x000001DC7D8C0000-0x000001DC7D8EA000-memory.dmpFilesize
168KB
-
memory/336-271-0x000001DC7D8C0000-0x000001DC7D8EA000-memory.dmpFilesize
168KB
-
memory/408-35-0x000001987CE60000-0x000001987CE8A000-memory.dmpFilesize
168KB
-
memory/408-36-0x00007FF827C70000-0x00007FF827C80000-memory.dmpFilesize
64KB
-
memory/408-274-0x000001987CE60000-0x000001987CE8A000-memory.dmpFilesize
168KB
-
memory/616-269-0x00007FF867C8D000-0x00007FF867C8E000-memory.dmpFilesize
4KB
-
memory/616-268-0x000001B85E3F0000-0x000001B85E41A000-memory.dmpFilesize
168KB
-
memory/616-18-0x000001B85E3C0000-0x000001B85E3E3000-memory.dmpFilesize
140KB
-
memory/616-19-0x000001B85E3F0000-0x000001B85E41A000-memory.dmpFilesize
168KB
-
memory/616-20-0x00007FF827C70000-0x00007FF827C80000-memory.dmpFilesize
64KB
-
memory/676-24-0x00007FF827C70000-0x00007FF827C80000-memory.dmpFilesize
64KB
-
memory/676-270-0x000001CECF920000-0x000001CECF94A000-memory.dmpFilesize
168KB
-
memory/676-23-0x000001CECF920000-0x000001CECF94A000-memory.dmpFilesize
168KB
-
memory/956-33-0x00007FF827C70000-0x00007FF827C80000-memory.dmpFilesize
64KB
-
memory/956-272-0x000001FC77FD0000-0x000001FC77FFA000-memory.dmpFilesize
168KB
-
memory/956-32-0x000001FC77FD0000-0x000001FC77FFA000-memory.dmpFilesize
168KB
-
memory/956-273-0x00007FF867C8C000-0x00007FF867C8D000-memory.dmpFilesize
4KB
-
memory/1032-275-0x0000011C9A330000-0x0000011C9A35A000-memory.dmpFilesize
168KB
-
memory/1032-41-0x0000011C9A330000-0x0000011C9A35A000-memory.dmpFilesize
168KB
-
memory/1032-42-0x00007FF827C70000-0x00007FF827C80000-memory.dmpFilesize
64KB
-
memory/1120-276-0x0000020F253B0000-0x0000020F253DA000-memory.dmpFilesize
168KB
-
memory/1120-45-0x00007FF827C70000-0x00007FF827C80000-memory.dmpFilesize
64KB
-
memory/1120-44-0x0000020F253B0000-0x0000020F253DA000-memory.dmpFilesize
168KB
-
memory/1128-47-0x0000023E95690000-0x0000023E956BA000-memory.dmpFilesize
168KB
-
memory/1128-48-0x00007FF827C70000-0x00007FF827C80000-memory.dmpFilesize
64KB
-
memory/1156-53-0x00000260D5B40000-0x00000260D5B6A000-memory.dmpFilesize
168KB
-
memory/1156-54-0x00007FF827C70000-0x00007FF827C80000-memory.dmpFilesize
64KB
-
memory/1252-56-0x00000285B4E90000-0x00000285B4EBA000-memory.dmpFilesize
168KB
-
memory/1252-57-0x00007FF827C70000-0x00007FF827C80000-memory.dmpFilesize
64KB
-
memory/1296-59-0x000001AEEE340000-0x000001AEEE36A000-memory.dmpFilesize
168KB
-
memory/1296-60-0x00007FF827C70000-0x00007FF827C80000-memory.dmpFilesize
64KB
-
memory/1308-63-0x000002B706140000-0x000002B70616A000-memory.dmpFilesize
168KB
-
memory/1308-64-0x00007FF827C70000-0x00007FF827C80000-memory.dmpFilesize
64KB
-
memory/1464-11-0x0000000140000000-0x0000000140040000-memory.dmpFilesize
256KB
-
memory/1464-10-0x0000000140000000-0x0000000140040000-memory.dmpFilesize
256KB
-
memory/1464-13-0x00007FF867BF0000-0x00007FF867DE5000-memory.dmpFilesize
2.0MB
-
memory/1464-15-0x0000000140000000-0x0000000140040000-memory.dmpFilesize
256KB
-
memory/1464-14-0x00007FF8663C0000-0x00007FF86647E000-memory.dmpFilesize
760KB
-
memory/1464-12-0x0000000140000000-0x0000000140040000-memory.dmpFilesize
256KB
-
memory/4876-7-0x000001BBB4660000-0x000001BBB469E000-memory.dmpFilesize
248KB
-
memory/4876-9-0x00007FF8663C0000-0x00007FF86647E000-memory.dmpFilesize
760KB
-
memory/4876-8-0x00007FF867BF0000-0x00007FF867DE5000-memory.dmpFilesize
2.0MB
-
memory/4876-0-0x000001BBB29F0000-0x000001BBB2A08000-memory.dmpFilesize
96KB
-
memory/4876-6-0x00007FF849CA0000-0x00007FF84A761000-memory.dmpFilesize
10.8MB
-
memory/4876-5-0x00007FF849CA3000-0x00007FF849CA5000-memory.dmpFilesize
8KB
-
memory/4876-4-0x000001BBCD890000-0x000001BBCDDB8000-memory.dmpFilesize
5.2MB
-
memory/4876-3-0x00007FF849CA0000-0x00007FF84A761000-memory.dmpFilesize
10.8MB
-
memory/4876-2-0x000001BBCD090000-0x000001BBCD252000-memory.dmpFilesize
1.8MB
-
memory/4876-1-0x00007FF849CA3000-0x00007FF849CA5000-memory.dmpFilesize
8KB
-
memory/4876-301-0x000001BBCEE70000-0x000001BBCEEE6000-memory.dmpFilesize
472KB
-
memory/4876-302-0x000001BBB46D0000-0x000001BBB46E2000-memory.dmpFilesize
72KB
-
memory/4876-303-0x000001BBCD670000-0x000001BBCD68E000-memory.dmpFilesize
120KB