Resubmissions
13/07/2024, 19:37
240713-ybwfxavapr1013/07/2024, 19:36
240713-ybjr4svapk1013/07/2024, 19:36
240713-ya74bavamp1013/07/2024, 19:34
240713-yabp4svakk1013/07/2024, 19:29
240713-x7eycswerg10Analysis
- max time kernel
10s - max time network
12s - platform
windows10-2004_x64 - resource
win10v2004-20240709-uk - resource tags
arch:x64arch:x86image:win10v2004-20240709-uklocale:uk-uaos:windows10-2004-x64systemwindows - submitted
13/07/2024, 19:36
Behavioral task
behavioral1
Sample
rostrap.exe
Resource
win10v2004-20240709-uk
windows10-2004-x64
13 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target rostrap.exe
- Size 78KB
- Sample240713-ya74bavamp
- SHA256 9ddd3757585f55bea693a536e7ec6c4de0fd46f7df565f9cf6d10e339af2e845
- MD5 c806f00fa32f343f9849c77003bb4cc1
- SHA1 4a80c5b110f93d9dbcc85885bbf231de5ac8ace6
- SHA512 bac500e08913263bcabab7622eb7d00443d3d426cee9000edcd7b6089cf6e42be2a6b8f93fa60ef703b5400016febf8fb4c922ff17f2c80024a39450440deeb4
- SSDEEP 1536:Q0QhcOUX0RU1uB3Yec0OIwbJNrfxCXhRoKV6+V+ttD:Qojj03wbJNrmAE+DD
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTI2MTcwMjM0NDQ4ODUyMTgwOQ.GyJxES.iPPznz14IbFotKTZ3KViTwuS9T3PzEb13fnomo
-
server_id
1261715255004762132
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation rostrap.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
flow ioc 12 discord.com 20 discord.com 42 discord.com 11 discord.com - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Modifies data under HKEY_USERS 17 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "218" LogonUI.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133653729794617932" chrome.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2088 chrome.exe 2088 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe - Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 872 rostrap.exe Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe Token: SeShutdownPrivilege 2088 chrome.exe Token: SeCreatePagefilePrivilege 2088 chrome.exe Token: SeShutdownPrivilege 2448 shutdown.exe Token: SeRemoteShutdownPrivilege 2448 shutdown.exe - Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe - Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe 2088 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1652 LogonUI.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2088 wrote to memory of 5080 2088 chrome.exe 89 PID 2088 wrote to memory of 5080 2088 chrome.exe 89 PID 2088 wrote to memory of 1260 2088 chrome.exe 90 PID 2088 wrote to memory of 1260 2088 chrome.exe 90 PID 2088 wrote to memory of 1260 2088 chrome.exe 90 PID 2088 wrote to memory of 1260 2088 chrome.exe 90 PID 2088 wrote to memory of 1260 2088 chrome.exe 90 PID 2088 wrote to memory of 1260 2088 chrome.exe 90 PID 2088 wrote to memory of 1260 2088 chrome.exe 90 PID 2088 wrote to memory of 1260 2088 chrome.exe 90 PID 2088 wrote to memory of 1260 2088 chrome.exe 90 PID 2088 wrote to memory of 1260 2088 chrome.exe 90 PID 2088 wrote to memory of 1260 2088 chrome.exe 90 PID 2088 wrote to memory of 1260 2088 chrome.exe 90 PID 2088 wrote to memory of 1260 2088 chrome.exe 90 PID 2088 wrote to memory of 1260 2088 chrome.exe 90 PID 2088 wrote to memory of 1260 2088 chrome.exe 90 PID 2088 wrote to memory of 1260 2088 chrome.exe 90 PID 2088 wrote to memory of 1260 2088 chrome.exe 90 PID 2088 wrote to memory of 1260 2088 chrome.exe 90 PID 2088 wrote to memory of 1260 2088 chrome.exe 90 PID 2088 wrote to memory of 1260 2088 chrome.exe 90 PID 2088 wrote to memory of 1260 2088 chrome.exe 90 PID 2088 wrote to memory of 1260 2088 chrome.exe 90 PID 2088 wrote to memory of 1260 2088 chrome.exe 90 PID 2088 wrote to memory of 1260 2088 chrome.exe 90 PID 2088 wrote to memory of 1260 2088 chrome.exe 90 PID 2088 wrote to memory of 1260 2088 chrome.exe 90 PID 2088 wrote to memory of 1260 2088 chrome.exe 90 PID 2088 wrote to memory of 1260 2088 chrome.exe 90 PID 2088 wrote to memory of 1260 2088 chrome.exe 90 PID 2088 wrote to memory of 1260 2088 chrome.exe 90 PID 2088 wrote to memory of 632 2088 chrome.exe 91 PID 2088 wrote to memory of 632 2088 chrome.exe 91 PID 2088 wrote to memory of 4424 2088 chrome.exe 92 PID 2088 wrote to memory of 4424 2088 chrome.exe 92 PID 2088 wrote to memory of 4424 2088 chrome.exe 92 PID 2088 wrote to memory of 4424 2088 chrome.exe 92 PID 2088 wrote to memory of 4424 2088 chrome.exe 92 PID 2088 wrote to memory of 4424 2088 chrome.exe 92 PID 2088 wrote to memory of 4424 2088 chrome.exe 92 PID 2088 wrote to memory of 4424 2088 chrome.exe 92 PID 2088 wrote to memory of 4424 2088 chrome.exe 92 PID 2088 wrote to memory of 4424 2088 chrome.exe 92 PID 2088 wrote to memory of 4424 2088 chrome.exe 92 PID 2088 wrote to memory of 4424 2088 chrome.exe 92 PID 2088 wrote to memory of 4424 2088 chrome.exe 92 PID 2088 wrote to memory of 4424 2088 chrome.exe 92 PID 2088 wrote to memory of 4424 2088 chrome.exe 92 PID 2088 wrote to memory of 4424 2088 chrome.exe 92 PID 2088 wrote to memory of 4424 2088 chrome.exe 92 PID 2088 wrote to memory of 4424 2088 chrome.exe 92 PID 2088 wrote to memory of 4424 2088 chrome.exe 92 PID 2088 wrote to memory of 4424 2088 chrome.exe 92 PID 2088 wrote to memory of 4424 2088 chrome.exe 92 PID 2088 wrote to memory of 4424 2088 chrome.exe 92 PID 2088 wrote to memory of 4424 2088 chrome.exe 92 PID 2088 wrote to memory of 4424 2088 chrome.exe 92 PID 2088 wrote to memory of 4424 2088 chrome.exe 92 PID 2088 wrote to memory of 4424 2088 chrome.exe 92 PID 2088 wrote to memory of 4424 2088 chrome.exe 92 PID 2088 wrote to memory of 4424 2088 chrome.exe 92 PID 2088 wrote to memory of 4424 2088 chrome.exe 92 PID 2088 wrote to memory of 4424 2088 chrome.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\rostrap.exe"C:\Users\Admin\AppData\Local\Temp\rostrap.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
PID:872 -
C:\Windows\System32\shutdown.exe"C:\Windows\System32\shutdown.exe" /s /t 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb70d5cc40,0x7ffb70d5cc4c,0x7ffb70d5cc582⤵PID:5080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2040,i,7651134913044488069,9997613844715794386,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2024 /prefetch:22⤵PID:1260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2012,i,7651134913044488069,9997613844715794386,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2176 /prefetch:32⤵PID:632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1936,i,7651134913044488069,9997613844715794386,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2316 /prefetch:82⤵PID:4424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3100,i,7651134913044488069,9997613844715794386,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:2996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3260,i,7651134913044488069,9997613844715794386,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3416 /prefetch:12⤵PID:4928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4516,i,7651134913044488069,9997613844715794386,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4628 /prefetch:12⤵PID:1848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4836,i,7651134913044488069,9997613844715794386,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4852 /prefetch:82⤵PID:1048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5004,i,7651134913044488069,9997613844715794386,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=5020 /prefetch:82⤵PID:5096
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵PID:1820
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:968
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3941855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1652
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 8KB
- SHA256 d72a6c6b337ed95ed0d599a082148e3b9e6dfe85de148d3246f9a8aa2152c67f
- MD5 fab1e4b7c45c6f5d3ad4b179e9f7e3be
- SHA1 46c6d72012f0bd9dfb0473b30f7bd2feec1c73f1
- SHA512 2bf8225cf354b5db739fba2554eeb50b69b897d7ef8403620264163ea007ca44b3a0d7a75b8b4d234cf3f11c251bd7d7f225474df3b410524a468fa58cdd0a9e
- SSDEEP 192:J5bLC0mpSIylM6QejadHV+FRP5EFmqMPo6yIsnVdg4:JZLX863aNGRSFmqA4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 15KB
- SHA256 f4f22640032f44a9f5c70f4fd87af600e2aaeed7e87adc3fdc2637386b2af252
- MD5 ce2b3f5dffadedded8109a0696fa4f18
- SHA1 53986e3ec8c61fe5ae1110354fdf82b4b794f6e1
- SHA512 f16626b48d4d71d74f69b5a283b40aa77851b82a63657e38e8d0ae0020496a1f1f3f50cb5652482f9bf9b9083ac269a400018d5b5be40945983a8e1102c46b43
- SSDEEP 384:7u7WWH7pLhLcsBTu7fX/E1kXqKf/pUZNCgVLH2HfPzu7XrU1gHGux3zQt:7u7dH7pLhL9hu7P/E1kXqKf/pUZNCgV8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 181KB
- SHA256 a3c0e7a22e98892e9b15e53e71d0b22af3f5d7d28c89cd0d400d8825e39e3713
- MD5 48d6ecc2f00593cfac52fd5d87624f02
- SHA1 6bd9b154be0d64ae1bbda723f6b9a4f52785fb99
- SHA512 fd4c8c3c26659582cf05e091771020568f68a0e26f398df6dcca346f071dbea6f5be4b886637013859719ca9414f71c2069b2a6d2a5b531f4eba14c79b38d9dc
- SSDEEP 3072:6/2qqz8zr15CbQD1t1qj7ajgwyRnXq49d6SrAwfXbR/Wq8i/cXUWzgM4ANtZHKov:6/2qqz8zr1Aok7ajJyRa4SdwfbpWHikH
- MD5 SHA1 SHA512 SSDEEP