Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23-07-2024 17:32
Behavioral task
behavioral1
Sample
RvcUserInterFace.exe
Resource
win7-20240704-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
RvcUserInterFace.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
RvcUserInterFace.exe
-
Size
78KB
-
MD5
a93e4c430ad89942f59d9634116ea5c4
-
SHA1
9dd1419ca927a5e95e380f60693223b5fffbe89a
-
SHA256
2ad64e8dfd8a9799ed6a456fa784d1884164eedcea268c910e72fe543891cef2
-
SHA512
4d8420f7558f18be70544e8190b7e75f461c5401e8f1302e08431807232a10f821ebef7c318e8613aff37e7b739fb9a670903ae775a186dddcc82435b3ed0f59
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+pPIC:5Zv5PDwbjNrmAE+ZIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTE4NTI0NTc2NjExNDEwMzM1Nw.Gat4VC.1CnS9_cPhmJgKcEV43-EZxZET1Cj3kAzip89cM
-
server_id
1178376627995037726
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 10 discord.com 11 discord.com -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "70" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe -
Suspicious behavior: LoadsDriver 64 IoCs
pid Process 4880 Process not Found 4852 Process not Found 2244 Process not Found 4344 Process not Found 2548 Process not Found 3376 Process not Found 4540 Process not Found 3016 Process not Found 624 Process not Found 2088 Process not Found 3664 Process not Found 2620 Process not Found 3008 Process not Found 3452 Process not Found 4576 Process not Found 4844 Process not Found 4364 Process not Found 1952 Process not Found 1860 Process not Found 4228 Process not Found 4340 Process not Found 3388 Process not Found 1944 Process not Found 228 Process not Found 2092 Process not Found 224 Process not Found 3052 Process not Found 1792 Process not Found 3476 Process not Found 1872 Process not Found 3812 Process not Found 396 Process not Found 3656 Process not Found 4716 Process not Found 1200 Process not Found 2032 Process not Found 1904 Process not Found 3312 Process not Found 1460 Process not Found 880 Process not Found 2212 Process not Found 2572 Process not Found 4972 Process not Found 1444 Process not Found 4356 Process not Found 1216 Process not Found 2324 Process not Found 2440 Process not Found 3028 Process not Found 3288 Process not Found 4816 Process not Found 3292 Process not Found 2136 Process not Found 4116 Process not Found 2808 Process not Found 4136 Process not Found 3404 Process not Found 3556 Process not Found 1960 Process not Found 3824 Process not Found 2748 Process not Found 4984 Process not Found 3808 Process not Found 4444 Process not Found -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 216 RvcUserInterFace.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2184 LogonUI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\RvcUserInterFace.exe"C:\Users\Admin\AppData\Local\Temp\RvcUserInterFace.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:216
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3943055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2184