Analysis
-
max time kernel
32s -
max time network
33s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
19-07-2024 20:19
Behavioral task
behavioral1
Sample
FeatherB/FeatherBootstrapper.exe
Resource
win7-20240705-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
FeatherB/FeatherBootstrapper.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
FeatherB/FeatherBootstrapper.exe
-
Size
78KB
-
MD5
48d390347ce93ca2b34917da729c3006
-
SHA1
65104157ce6d62d4ac7c723bc5c4a2620c2aefbb
-
SHA256
cb9269ed714f14dbabd2df4f2dd0af7e686ff178470bb2189a6d35a7f42b5efa
-
SHA512
f68e1e253055988019b830cf37af69c67271904eb989b972bdcb2edfbc67e964b85c7d3e510ad19287ed74073e75759c4fa4a2fff0f35bf7fb09bcd09c3627dd
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+TPIC:5Zv5PDwbjNrmAE+LIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI2Mjc3ODU4MTgxNDIxNDc3Ng.GoRPys._68wmafo5T8UikhKXH678wKMr5nwbtLkTb_XXI
-
server_id
1262984138315530440
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1672 FeatherBootstrapper.exe Token: SeDebugPrivilege 1992 taskmgr.exe Token: SeSystemProfilePrivilege 1992 taskmgr.exe Token: SeCreateGlobalPrivilege 1992 taskmgr.exe -
Suspicious use of FindShellTrayWindow 41 IoCs
pid Process 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe -
Suspicious use of SendNotifyMessage 41 IoCs
pid Process 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe 1992 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FeatherB\FeatherBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\FeatherB\FeatherBootstrapper.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1672
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1992