Analysis

  • max time kernel
    15s
  • max time network
    19s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-07-2024 20:17

General

  • Target

    FeatherB/FeatherBootstrapper.exe

  • Size

    78KB

  • MD5

    48d390347ce93ca2b34917da729c3006

  • SHA1

    65104157ce6d62d4ac7c723bc5c4a2620c2aefbb

  • SHA256

    cb9269ed714f14dbabd2df4f2dd0af7e686ff178470bb2189a6d35a7f42b5efa

  • SHA512

    f68e1e253055988019b830cf37af69c67271904eb989b972bdcb2edfbc67e964b85c7d3e510ad19287ed74073e75759c4fa4a2fff0f35bf7fb09bcd09c3627dd

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+TPIC:5Zv5PDwbjNrmAE+LIC

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTI2Mjc3ODU4MTgxNDIxNDc3Ng.GoRPys._68wmafo5T8UikhKXH678wKMr5nwbtLkTb_XXI

  • server_id

    1262984138315530440

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 21 IoCs
  • Suspicious use of SendNotifyMessage 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\FeatherB\FeatherBootstrapper.exe
    "C:\Users\Admin\AppData\Local\Temp\FeatherB\FeatherBootstrapper.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4152
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:892

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/892-16-0x000001836D100000-0x000001836D101000-memory.dmp

    Filesize

    4KB

  • memory/892-15-0x000001836D100000-0x000001836D101000-memory.dmp

    Filesize

    4KB

  • memory/892-11-0x000001836D100000-0x000001836D101000-memory.dmp

    Filesize

    4KB

  • memory/892-12-0x000001836D100000-0x000001836D101000-memory.dmp

    Filesize

    4KB

  • memory/892-13-0x000001836D100000-0x000001836D101000-memory.dmp

    Filesize

    4KB

  • memory/892-5-0x000001836D100000-0x000001836D101000-memory.dmp

    Filesize

    4KB

  • memory/892-14-0x000001836D100000-0x000001836D101000-memory.dmp

    Filesize

    4KB

  • memory/892-17-0x000001836D100000-0x000001836D101000-memory.dmp

    Filesize

    4KB

  • memory/892-6-0x000001836D100000-0x000001836D101000-memory.dmp

    Filesize

    4KB

  • memory/892-7-0x000001836D100000-0x000001836D101000-memory.dmp

    Filesize

    4KB

  • memory/4152-1-0x00007FF8D6FC3000-0x00007FF8D6FC5000-memory.dmp

    Filesize

    8KB

  • memory/4152-0-0x0000017AFE1E0000-0x0000017AFE1F8000-memory.dmp

    Filesize

    96KB

  • memory/4152-4-0x0000017A98F00000-0x0000017A99428000-memory.dmp

    Filesize

    5.2MB

  • memory/4152-3-0x00007FF8D6FC0000-0x00007FF8D7A81000-memory.dmp

    Filesize

    10.8MB

  • memory/4152-2-0x0000017B001D0000-0x0000017B00392000-memory.dmp

    Filesize

    1.8MB