Analysis
-
max time kernel
41s -
max time network
35s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22-07-2024 21:24
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
a9e093dbd1c972fd8e7bf96e65bb57f7
-
SHA1
39f199923cc2a30c28b71ec8eaebc9abe17fd761
-
SHA256
3459e35226cf145ac143580a6507888db3810e9c28da3b04e54808b5d1149253
-
SHA512
1f08ffc2a1492942841a32253cbe666b0427783bb19fad7c7eb57e3427bb6777ea8aa062beeb524f543ba17d8ef1b1992089850e4a368cff9143bbe3236987ed
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+/PIC:5Zv5PDwbjNrmAE+HIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI2NTA1NTY5NzQzMTY5MTMyNQ.GedQFI.I4snNL2g6u0HkYShXIMfQrgS7oHmpa18Xp3utM
-
server_id
1241810215675101325
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 38 IoCs
pid Process 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1652 Client-built.exe Token: SeDebugPrivilege 3052 taskmgr.exe Token: SeSystemProfilePrivilege 3052 taskmgr.exe Token: SeCreateGlobalPrivilege 3052 taskmgr.exe -
Suspicious use of FindShellTrayWindow 48 IoCs
pid Process 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe 3052 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1652
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3052
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4944