discordrat | hxxps://www[.]google[.]com/url?sa=t&source=web&rct=j&opi=89978449&url=hxxps://github[.]com/moom825/Discord-RAT-2[.]0&ved=2ahUKEwi-8qHqjbWHAxVAl-4BHXE-CoYQFnoECBYQAQ&usg=AOvVaw39OOOea1JrI_BwXCYP38A7

Analysis

max time kernel
1800s
max time network
1687s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
20-07-2024 07:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=https://github.com/moom825/Discord-RAT-2.0&ved=2ahUKEwi-8qHqjbWHAxVAl-4BHXE-CoYQFnoECBYQAQ&usg=AOvVaw39OOOea1JrI_BwXCYP38A7

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Executes dropped EXE 1 IoCs

pid	Process
4352	Discord rat.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3468	msedge.exe
3468	msedge.exe
3576	msedge.exe
3576	msedge.exe
1244	identity_helper.exe
1244	identity_helper.exe
4712	msedge.exe
4712	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
1820	msedge.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeRestorePrivilege	2984	7zG.exe
Token: 35	2984	7zG.exe
Token: SeSecurityPrivilege	2984	7zG.exe
Token: SeSecurityPrivilege	2984	7zG.exe
Token: SeDebugPrivilege	4352	Discord rat.exe
Token: SeDebugPrivilege	4892	taskmgr.exe
Token: SeSystemProfilePrivilege	4892	taskmgr.exe
Token: SeCreateGlobalPrivilege	4892	taskmgr.exe
Token: 33	4892	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4892	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
2984	7zG.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe

Suspicious use of SendNotifyMessage 63 IoCs

pid	Process
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe
4892	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3576 wrote to memory of 4576	3576	msedge.exe	84
PID 3576 wrote to memory of 4576	3576	msedge.exe	84
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3976	3576	msedge.exe	85
PID 3576 wrote to memory of 3468	3576	msedge.exe	86
PID 3576 wrote to memory of 3468	3576	msedge.exe	86
PID 3576 wrote to memory of 4304	3576	msedge.exe	87
PID 3576 wrote to memory of 4304	3576	msedge.exe	87
PID 3576 wrote to memory of 4304	3576	msedge.exe	87
PID 3576 wrote to memory of 4304	3576	msedge.exe	87
PID 3576 wrote to memory of 4304	3576	msedge.exe	87
PID 3576 wrote to memory of 4304	3576	msedge.exe	87
PID 3576 wrote to memory of 4304	3576	msedge.exe	87
PID 3576 wrote to memory of 4304	3576	msedge.exe	87
PID 3576 wrote to memory of 4304	3576	msedge.exe	87
PID 3576 wrote to memory of 4304	3576	msedge.exe	87
PID 3576 wrote to memory of 4304	3576	msedge.exe	87
PID 3576 wrote to memory of 4304	3576	msedge.exe	87
PID 3576 wrote to memory of 4304	3576	msedge.exe	87
PID 3576 wrote to memory of 4304	3576	msedge.exe	87
PID 3576 wrote to memory of 4304	3576	msedge.exe	87
PID 3576 wrote to memory of 4304	3576	msedge.exe	87
PID 3576 wrote to memory of 4304	3576	msedge.exe	87
PID 3576 wrote to memory of 4304	3576	msedge.exe	87
PID 3576 wrote to memory of 4304	3576	msedge.exe	87
PID 3576 wrote to memory of 4304	3576	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=https://github.com/moom825/Discord-RAT-2.0&ved=2ahUKEwi-8qHqjbWHAxVAl-4BHXE-CoYQFnoECBYQAQ&usg=AOvVaw39OOOea1JrI_BwXCYP38A7
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdccaf46f8,0x7ffdccaf4708,0x7ffdccaf4718
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,9663211168679285838,9171142023145539121,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,9663211168679285838,9171142023145539121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,9663211168679285838,9171142023145539121,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,9663211168679285838,9171142023145539121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,9663211168679285838,9171142023145539121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,9663211168679285838,9171142023145539121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,9663211168679285838,9171142023145539121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,9663211168679285838,9171142023145539121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,9663211168679285838,9171142023145539121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,9663211168679285838,9171142023145539121,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,9663211168679285838,9171142023145539121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,9663211168679285838,9171142023145539121,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2180,9663211168679285838,9171142023145539121,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4780 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,9663211168679285838,9171142023145539121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2180,9663211168679285838,9171142023145539121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,9663211168679285838,9171142023145539121,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=2180,9663211168679285838,9171142023145539121,131072 --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=3552 /prefetch:8
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,9663211168679285838,9171142023145539121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4548 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,9663211168679285838,9171142023145539121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,9663211168679285838,9171142023145539121,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3900 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3460

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4912

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap17399:72:7zEvent1475
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2984

C:\Users\Admin\Desktop\Release\builder.exe
"C:\Users\Admin\Desktop\Release\builder.exe"
1⤵
PID:2540

C:\Users\Admin\Desktop\Release\Discord rat.exe
"C:\Users\Admin\Desktop\Release\Discord rat.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4352

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4892

C:\Users\Admin\Desktop\Release\builder.exe
"C:\Users\Admin\Desktop\Release\builder.exe"
1⤵
PID:5336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\builder.exe.log

Filesize
1KB

MD5
7ebe314bf617dc3e48b995a6c352740c

SHA1
538f643b7b30f9231a3035c448607f767527a870

SHA256
48178f884b8a4dd96e330b210b0530667d9473a7629fc6b4ad12b614bf438ee8

SHA512
0ba9d8f4244c15285e254d27b4bff7c49344ff845c48bc0bf0d8563072fab4d6f7a6abe6b6742e8375a08e9a3b3e5d5dc4937ab428dbe2dd8e62892fda04507e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d406f3135e11b0a0829109c1090a41dc

SHA1
810f00e803c17274f9af074fc6c47849ad6e873e

SHA256
91f57909a10174b06c862089a9c1f3b3aeafea74a70ee1942ce11bb80d9eace4

SHA512
2b9f0f94b1e8a1b62ab38af8df2add0ec9e4c6dfa94d9c84cc24fe86d2d57d4fc0d9ec8a9775cf42a859ddfd130260128185a0e2588992bca8fd4ebf5ee6d409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7f37f119665df6beaa925337bbff0e84

SHA1
c2601d11f8aa77e12ab3508479cbf20c27cbd865

SHA256
1073dbff3ec315ac85361c35c8ba791cc4198149b097c7b287dda1d791925027

SHA512
8e180e41dd27c51e81788564b19b8ff411028890da506fbf767d394b1e73ec53e046c8d07235b2ec7c1c593c976bbf74ed9b7d442d68b526a0a77a9b5b0ab817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
44e0eb0fbd4e40a85ee4da7551d7ba3f

SHA1
377c359c88da7fbae9425410323e8cfd32c148ca

SHA256
766ae0ea51c4c61844bdad4d413f215a481e63a89dcd698cd1fe00d778d7f055

SHA512
1a76eaf52a8101db4a72394657949daae23b0de4d6d5cf07531e6f0fe724f253e13a5c9eea379df33ec76dbc1d9754edb33a5a74ad1cf5eb7c53ecd75ea7eb61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
689B

MD5
856921310852645c691a0ed20410c23a

SHA1
384cb938ba7aff2c653f3d2e744be885a57e6bc7

SHA256
8d1614def624eeca1dcc07074f39d1eb0e88cca3e13cb4d90b24f8482d2a01ae

SHA512
98448636698b91f0b879e916f6afcde169380408af09b0e71a3dad05edda2baba25033a0729fcbff2a19147efbdf57ae0527d8945243d3b0b68e99b8cc6db3e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ea8ef84272d0c7f13f8d7b20b9423642

SHA1
9caf22fe56cadf1b62ac07fe96d9c3a66af930c9

SHA256
8b38e26e9c0553a745b529cf0a155731932d39d3a16c21a132e190bf9583fa0e

SHA512
5e5af1f43f4685e823a87a129a4ab33593d4558db5a3c5c2d7b975549738d28cb36adc8d1c688e729053b7c7a885d1752dd0e98a1caf50dc26b2013ae8f163fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3eaea9bdb39f015c5988db692035c8bd

SHA1
d55dfe75e5bdfdddc847a07c22cb5ab2dc8a25f4

SHA256
e31e91716013f91a9ae5e5f55ffdd1517c1f02efcc3a8f71249cd2cb3848a569

SHA512
db6dddacb4f8fb965fbd68b25d660eaa7705623fba71b1ea33f17a09f765ed520926c2de35d8af248f0a6f26569ed6450eb0087d32cdcd1c09279fa9d6676d0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
427d9ec86354f414c4841daf63e25040

SHA1
3cd7e7706e677be153b915aaff2e42ee6868eab5

SHA256
6484af4313eaf237e1288fff6bb0924d1466d39549fca91cf97ff7bfbd56f292

SHA512
14727ecd5f7aa33cbe977e96c08a16f790833603af27475530a26fa60e90cb17ea184726bec8a9b39fde18ed41c4b5756dcf84accf5fd869d035400bbf71231c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bc6520ef38118db98bfc991645bddcad

SHA1
107af53fb26e6b415277f9c5dcb40b19d5563b99

SHA256
84e41e9165593ac40188d06daf47e21fa1acbb8519c2faa1ac5e50ca448fd0e3

SHA512
bac3b83bea30af24e5fc275a1fac5c7bbf2ad131467c51b2c22f546efeed2cff21b81837770cc506e792ff312cc1c80b7dadf845b85231e0087a836bfb790b16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a0d19b053f16d618b2660d232b2745bf

SHA1
f8c2e2ba8a5ef49dc8f10d1c2d29b557c0b0a042

SHA256
d44d15288a66e203acfee56446afd4aa9ce7c1087c1164bce13721e9adff88ca

SHA512
a80b70c2b22d4476f346aa99e2f089be285818eedd3f1a35043ef7daefa3d545e48ad8e1aa50ac4dea583e5f61756e53fd7c53ee14490f2831ae011253cf1c56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4f02aa7d1b2e9a8176c5363430c5f48e

SHA1
58497b0b905aa8c025f05521b14d7af72cf67594

SHA256
ef119294d30939729205dbf257ebe83471e2205d976298aa4b534616af61ce72

SHA512
85911cc42d265ad3cd90dca7eac0fb0c7aeef3b4fd6bd36e5ec05327020974ee212f1349c6200bd2f9722df78b4d3f1669bbb3ee796b9e26616db733ee07d20c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c6ba3834f395d6bc0a72a1615bd4493b

SHA1
fa89443873d72f37b15e107a24d06ef5d162c42a

SHA256
8e7c51f75ecafcb450d67885e2c8f15ffb86c2476befe3d7ee43ae531afb8920

SHA512
f20ffa8e035503960f4b40988547f3f2568acb969fbe71d400f7883aa18736434697b42239dceb6973ba18fed97207b9a8597672e108b3a8ae022bcdfd8f98fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e932a039227de7630cf02f5a3221f06f

SHA1
e6d917a11e2b449f5989da3acd8f5182f99dac06

SHA256
795d61dda80026c26aac7d62b955162c535029d630f285a6c14fd3e279f8e992

SHA512
d07ac69832fa3383c27200e240e3df6a0a4e82172e1cc2dad418ddcd60b007ba99c43bf16a806f6af64ebd759502ef1b25c3ca603e3c6cb3d3adbbbd7ff9c75e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fbb5.TMP

Filesize
1KB

MD5
9c3c499fa35433fe01239b4a65bbe383

SHA1
4a5720623eed91abf67bb8f7cf95c77660bc3264

SHA256
2dfd46817a741794acefa8fc725e81305af43c467f279966cf166af66c571b34

SHA512
80603b44f71146ff63b76746b282b8b633f76418af8e8e787e9e9ca960b31439cf9525a97d434bb9e96df6343cd443fdeb97d7dcc6c9265d029f0e2ff307fb4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9e83b81a5910e22e73f2f6ace65e8ac2

SHA1
9cb6b9a3127772b8fa1cfcfb391b7987824a2848

SHA256
6488ac2c871789c70e303cdc1f513cf2dd37f030109adac1fb4a905e07a22498

SHA512
85e1d4588b201800d88218c81a56da6956e1e3f8da0118092127bd77e4598dd7238157e9add8e8371cd88bef2e4d3071b57ef700de7660ac1ea69a39443e2876

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
445bf6c908ef0353b96a98d6307f752b

SHA1
9814edfac72bc5e0615c05d22652a066f33b04b8

SHA256
c40edcd8de7236c8a23d45bac2cfcbdf8873e7e28fdadb0dff20766c196af128

SHA512
5b9522c054e95bf967dc8d4a526080bcffa42a6a1cf3c385b22ca97daf107c17b787e2f4c67647661cb3072ffbd8a4dfcb876a731e8f25067da289b06be8605d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
e3e8bd27eed0fa28aa038b3654e17bcc

SHA1
30796f87bb411497d916565b758e66db59b90881

SHA256
fcbeaff18e309f071048bd68f2353ffdb928c267acf67c719e87c08fa90082d4

SHA512
0d3cb9f0b36f77f542b26bc654e5f4ce0b9551ac9b6a8f4b3ec8c5b1504851c3a6cf319fa7fe44ded547b5f74ddac9a13df65af55e64d11ef9525b5e3ba5fd0c

Download Submit
C:\Users\Admin\Desktop\Release\Discord rat.exe

Filesize
79KB

MD5
d13905e018eb965ded2e28ba0ab257b5

SHA1
6d7fe69566fddc69b33d698591c9a2c70d834858

SHA256
2bd631c6665656673a923c13359b0dc211debc05b2885127e26b0dce808e2dec

SHA512
b95bfdebef33ac72b6c21cdf0abb4961222b7efd17267cd7236e731dd0b6105ece28e784a95455f1ffc8a6dd1d580a467b07b3bd8cb2fb19e2111f1a864c97cb

Download Submit
C:\Users\Admin\Downloads\release.zip

Filesize
445KB

MD5
06a4fcd5eb3a39d7f50a0709de9900db

SHA1
50d089e915f69313a5187569cda4e6dec2d55ca7

SHA256
c13a0cd7c2c2fd577703bff026b72ed81b51266afa047328c8ff1c4a4d965c97

SHA512
75e5f637fd3282d088b1c0c1efd0de8a128f681e4ac66d6303d205471fe68b4fbf0356a21d803aff2cca6def455abad8619fedc8c7d51e574640eda0df561f9b

Download Submit
memory/2540-370-0x0000000000490000-0x0000000000498000-memory.dmp

Filesize
32KB

Download
memory/2540-373-0x0000000004E90000-0x0000000004E9A000-memory.dmp

Filesize
40KB

Download
memory/2540-374-0x0000000006240000-0x0000000006362000-memory.dmp

Filesize
1.1MB

Download
memory/2540-372-0x0000000004EB0000-0x0000000004F42000-memory.dmp

Filesize
584KB

Download
memory/2540-371-0x0000000005460000-0x0000000005A04000-memory.dmp

Filesize
5.6MB

Download
memory/4352-379-0x00000220E0FA0000-0x00000220E0FB8000-memory.dmp

Filesize
96KB

Download
memory/4352-380-0x00000220FB5D0000-0x00000220FB792000-memory.dmp

Filesize
1.8MB

Download
memory/4352-381-0x00000220FBDD0000-0x00000220FC2F8000-memory.dmp

Filesize
5.2MB

Download
memory/4892-386-0x0000018D03EA0000-0x0000018D03EA1000-memory.dmp

Filesize
4KB

Download
memory/4892-388-0x0000018D03EA0000-0x0000018D03EA1000-memory.dmp

Filesize
4KB

Download
memory/4892-393-0x0000018D03EA0000-0x0000018D03EA1000-memory.dmp

Filesize
4KB

Download
memory/4892-398-0x0000018D03EA0000-0x0000018D03EA1000-memory.dmp

Filesize
4KB

Download
memory/4892-397-0x0000018D03EA0000-0x0000018D03EA1000-memory.dmp

Filesize
4KB

Download
memory/4892-396-0x0000018D03EA0000-0x0000018D03EA1000-memory.dmp

Filesize
4KB

Download
memory/4892-395-0x0000018D03EA0000-0x0000018D03EA1000-memory.dmp

Filesize
4KB

Download
memory/4892-394-0x0000018D03EA0000-0x0000018D03EA1000-memory.dmp

Filesize
4KB

Download
memory/4892-392-0x0000018D03EA0000-0x0000018D03EA1000-memory.dmp

Filesize
4KB

Download
memory/4892-387-0x0000018D03EA0000-0x0000018D03EA1000-memory.dmp

Filesize
4KB

Download