Resubmissions
04-07-2024 02:13
240704-cnpy1aygpn 10Analysis
-
max time kernel
60s -
max time network
62s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
04-07-2024 02:13
Behavioral task
behavioral1
Sample
Release/Discord rat.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
builder.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
dnlib.dll
Resource
win10v2004-20240611-en
General
-
Target
builder.exe
-
Size
10KB
-
MD5
4f04f0e1ff050abf6f1696be1e8bb039
-
SHA1
bebf3088fff4595bfb53aea6af11741946bbd9ce
-
SHA256
ded51c306ee7e59fa15c42798c80f988f6310ea77ab77de3d12dc01233757cfa
-
SHA512
94713824b81de323e368fde18679ef8b8f2883378bffd2b7bd2b4e4bd5d48b35c6e71c9f8e9b058ba497db1bd0781807e5b7cecfd540dad611da0986c72b9f12
-
SSDEEP
96:IJXYAuB2glBLgyOk3LxdjP2rm549JSTuwUYXzP+B1izXTa/HFpff3LG+tzNt:IJXDk7LI4uwtDPC1ijCHffSs
Malware Config
Signatures
-
Modifies data under HKEY_USERS 15 IoCs
Processes:
LogonUI.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "197" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe -
Suspicious behavior: LoadsDriver 64 IoCs
Processes:
pid process 2308 884 4784 220 1420 4876 4776 3664 4276 2744 2120 208 2136 3028 1376 3456 3940 4228 4936 1256 4964 1340 4884 4428 2020 2448 4932 4812 5016 960 2016 4488 3660 1688 1760 4440 4788 1828 2824 4140 3908 3856 3548 3876 896 5052 4748 4296 3828 4312 532 880 4540 452 3916 3712 4780 1996 3848 2700 4792 1000 3328 1948 -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
LogonUI.exepid process 756 LogonUI.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
cmd.exedescription pid process target process PID 1704 wrote to memory of 4596 1704 cmd.exe shutdown.exe PID 1704 wrote to memory of 4596 1704 cmd.exe shutdown.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\builder.exe"C:\Users\Admin\AppData\Local\Temp\builder.exe"1⤵PID:2216
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4324,i,11749492925348081608,8895412282206755658,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:81⤵PID:4944
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\system32\shutdown.exeshutdown /l2⤵PID:4596
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3901855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:756
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2216-0-0x000000007526E000-0x000000007526F000-memory.dmpFilesize
4KB
-
memory/2216-1-0x0000000000690000-0x0000000000698000-memory.dmpFilesize
32KB
-
memory/2216-2-0x0000000005680000-0x0000000005C24000-memory.dmpFilesize
5.6MB
-
memory/2216-3-0x00000000050D0000-0x0000000005162000-memory.dmpFilesize
584KB
-
memory/2216-4-0x0000000075260000-0x0000000075A10000-memory.dmpFilesize
7.7MB
-
memory/2216-5-0x0000000002D60000-0x0000000002D6A000-memory.dmpFilesize
40KB
-
memory/2216-6-0x0000000006470000-0x0000000006592000-memory.dmpFilesize
1.1MB
-
memory/2216-8-0x000000007526E000-0x000000007526F000-memory.dmpFilesize
4KB
-
memory/2216-9-0x0000000075260000-0x0000000075A10000-memory.dmpFilesize
7.7MB
-
memory/2216-10-0x0000000075260000-0x0000000075A10000-memory.dmpFilesize
7.7MB