Analysis
- max time kernel
144s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
03/08/2024, 08:00
Behavioral task
behavioral1
Sample
Release/Discord rat.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
300 seconds
Behavioral task
behavioral2
Sample
builder.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
300 seconds
Behavioral task
behavioral3
Sample
dnlib.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
300 seconds
General
- Target builder.exe
- Size 10KB
- Sample240803-jv2ppsxclj
- SHA256 ded51c306ee7e59fa15c42798c80f988f6310ea77ab77de3d12dc01233757cfa
- MD5 4f04f0e1ff050abf6f1696be1e8bb039
- SHA1 bebf3088fff4595bfb53aea6af11741946bbd9ce
- SHA512 94713824b81de323e368fde18679ef8b8f2883378bffd2b7bd2b4e4bd5d48b35c6e71c9f8e9b058ba497db1bd0781807e5b7cecfd540dad611da0986c72b9f12
- SSDEEP 96:IJXYAuB2glBLgyOk3LxdjP2rm549JSTuwUYXzP+B1izXTa/HFpff3LG+tzNt:IJXDk7LI4uwtDPC1ijCHffSs
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language builder.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4116 msedge.exe 4116 msedge.exe 3200 msedge.exe 3200 msedge.exe 4012 identity_helper.exe 4012 identity_helper.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe - Suspicious use of FindShellTrayWindow 58 IoCs
pid Process 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe - Suspicious use of SendNotifyMessage 56 IoCs
pid Process 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe 3200 msedge.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3200 wrote to memory of 4960 3200 msedge.exe 99 PID 3200 wrote to memory of 4960 3200 msedge.exe 99 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4828 3200 msedge.exe 100 PID 3200 wrote to memory of 4116 3200 msedge.exe 101 PID 3200 wrote to memory of 4116 3200 msedge.exe 101 PID 3200 wrote to memory of 1812 3200 msedge.exe 102 PID 3200 wrote to memory of 1812 3200 msedge.exe 102 PID 3200 wrote to memory of 1812 3200 msedge.exe 102 PID 3200 wrote to memory of 1812 3200 msedge.exe 102 PID 3200 wrote to memory of 1812 3200 msedge.exe 102 PID 3200 wrote to memory of 1812 3200 msedge.exe 102 PID 3200 wrote to memory of 1812 3200 msedge.exe 102 PID 3200 wrote to memory of 1812 3200 msedge.exe 102 PID 3200 wrote to memory of 1812 3200 msedge.exe 102 PID 3200 wrote to memory of 1812 3200 msedge.exe 102 PID 3200 wrote to memory of 1812 3200 msedge.exe 102 PID 3200 wrote to memory of 1812 3200 msedge.exe 102 PID 3200 wrote to memory of 1812 3200 msedge.exe 102 PID 3200 wrote to memory of 1812 3200 msedge.exe 102 PID 3200 wrote to memory of 1812 3200 msedge.exe 102 PID 3200 wrote to memory of 1812 3200 msedge.exe 102 PID 3200 wrote to memory of 1812 3200 msedge.exe 102 PID 3200 wrote to memory of 1812 3200 msedge.exe 102 PID 3200 wrote to memory of 1812 3200 msedge.exe 102 PID 3200 wrote to memory of 1812 3200 msedge.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\builder.exe"C:\Users\Admin\AppData\Local\Temp\builder.exe"1⤵
- System Location Discovery: System Language Discovery
PID:1460
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffce08f46f8,0x7ffce08f4708,0x7ffce08f47182⤵PID:4960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,3932418589095218012,13891974674122017913,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:22⤵PID:4828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,3932418589095218012,13891974674122017913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,3932418589095218012,13891974674122017913,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2964 /prefetch:82⤵PID:1812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,3932418589095218012,13891974674122017913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:12⤵PID:1216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,3932418589095218012,13891974674122017913,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:12⤵PID:116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,3932418589095218012,13891974674122017913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:12⤵PID:4048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,3932418589095218012,13891974674122017913,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:12⤵PID:1976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,3932418589095218012,13891974674122017913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4164 /prefetch:82⤵PID:3648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,3932418589095218012,13891974674122017913,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4164 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,3932418589095218012,13891974674122017913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:12⤵PID:4368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,3932418589095218012,13891974674122017913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:12⤵PID:3252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,3932418589095218012,13891974674122017913,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3704 /prefetch:12⤵PID:1656
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3676
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3108
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89
- MD5 e765f3d75e6b0e4a7119c8b14d47d8da
- SHA1 cc9f7c7826c2e1a129e7d98884926076c3714fc0
- SHA512 a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 152B
- SHA256 b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771
- MD5 53bc70ecb115bdbabe67620c416fe9b3
- SHA1 af66ec51a13a59639eaf54d62ff3b4f092bb2fc1
- SHA512 cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 9c64ea49b2bc001ef45aa1fdd055120f07c75fc2cd498f50827a5809fa34a416
- MD5 051e68820018d76ddf7d5ce2b9e6d46e
- SHA1 72770ea96a1402e03da882b7550190099a4ad740
- SHA512 e7df9401242d1917c54c5b929d65680a53bd479f06ec0970203b705eca6d3e2341a8987ffa638c3f7f00f2d4b1fe7a74024d3747b715f7fa43ce2547c852faaa
- SSDEEP 96:nOFktUKs12aRQwpvWMoiVmdeH85qSYUWQyV+VDCziEwb:n4ktOcaRQGWMX3ro
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 6KB
- SHA256 c46d66b23f35ed757a89b1d88b2c979fe3bea0ec8893439ff814b78b2dbe5429
- MD5 e6320b6b2ba01b4e55a3c083868561f8
- SHA1 714a7ec78760d349dd5abbc59759fe2ae7f3d924
- SHA512 5a4119ef36a9d7225afdee5667c9d1f595171b7a0059bbec24c91388cc4643f9e3f5c427afc36dde701e21a4a90be24e9b8fa58a771649836e1f33b7256d567d
- SSDEEP 96:nOFktUKs12KRQwpvWMoiVmdeH85qSYUWQyV+VD7AiEwb:n4ktOcKRQGWMX3rg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
- Size 16B
- SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
- MD5 6752a1d65b201c13b62ea44016eb221f
- SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
- SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 de5181218f89125308f07ee34829aaedac7bee00e4411b7736a542bf87e62f2f
- MD5 3806de390fe37e141e9e90cd888e2998
- SHA1 6873bdbd4568d61320b2386c93c0f375b8870052
- SHA512 e641c0372be333d7bd328794f910901bd5bf033bee33181b26199f4deb2d72eef1a705807a29e4092b9debc6e416bc838a69a20334338881a2bc5b2ac3c67fb0
- SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupvRcl7e2RU67i+JW:A9iIxuERzA83h09RZxY5orHVJW
- MD5 SHA1 SHA512 SSDEEP