Analysis
- max time kernel
210s - max time network
206s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
26/07/2024, 14:04
General
- Target RoblxExtern.exe
- Size 103KB
- Sample240726-rdd63sscnn
- SHA256 60f0ed4e327ec2f37874d39d7d8112edd3ee5f3a88ac09d55f1e860ad1d16aab
Malware Config
Extracted
-
discordrat
-
discord_token
MTI2MTY0NTg1NzE3MDY1MzIyNQ.G-aI1H.UjEBfSThVUjdMTWjryej5I5a1-xdH_S2NvpjfA
-
server_id
1261645179203616778
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 19 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\RoblxExtern.exe"C:\Users\Admin\AppData\Local\Temp\RoblxExtern.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Office\COM SURROGATE.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Office\COM Surrogate.exe"C:\Users\Admin\AppData\Local\Office\COM SURROGATE.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77COM Surrogate.exe" /tr "'C:\Users\Admin\AppData\Local\Office\COM Surrogate.exe'" /sc onlogon /rl HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
COM Surrogate.exe
Newtonsoft.Json.dll
SQLite.Interop.dll
memory/2592-24-0x00007FFB6DF50000-0x00007FFB6EA11000-memory.dmp
memory/2592-49-0x000002747A630000-0x000002747A6E2000-memory.dmp
memory/2592-25-0x0000027478F90000-0x00000274794B8000-memory.dmp
memory/2592-26-0x0000027478A60000-0x0000027478D2A000-memory.dmp
memory/2592-27-0x000002745FD00000-0x000002745FD0A000-memory.dmp
memory/2592-29-0x000002745FE40000-0x000002745FE52000-memory.dmp
memory/2592-47-0x0000027478700000-0x000002747876A000-memory.dmp
memory/2592-23-0x0000027478790000-0x0000027478952000-memory.dmp
memory/2592-22-0x00007FFB6DF53000-0x00007FFB6DF55000-memory.dmp
memory/2592-21-0x000002745E0A0000-0x000002745E0BC000-memory.dmp
memory/2592-56-0x0000027478F30000-0x0000027478F6A000-memory.dmp
memory/2592-57-0x000002745FEA0000-0x000002745FEC6000-memory.dmp
memory/2592-61-0x00007FFB6DF53000-0x00007FFB6DF55000-memory.dmp
memory/2592-62-0x00007FFB6DF50000-0x00007FFB6EA11000-memory.dmp