Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11-08-2024 15:54
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240729-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Client-built.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
c56402aa71cbd79d6d6b88ce0f496b1c
-
SHA1
bc975d039ee9f1b3b94e7c13d3c0ba59a1571204
-
SHA256
064fae8bfdfbbd03cb8fcc4595ef64fbe150086e524e0bdc0c03f9318e7fca96
-
SHA512
62ff9a7ecd014d8d95a485a64808402f762518cb5aabd3e71485e94eff388d868253b7a9fc36aab4cfa301a36db71cdaf96085c819f57f024d5621a8607a0c0a
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+fPIC:5Zv5PDwbjNrmAE+nIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTAwNjIwODg2NTI0MDYxMjk4Ng.GBKh6L.m3Qaw6w3t6NUbjPUrUJ8Y_JgBdPHM_bBhT652s
-
server_id
1235244401433772182
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 8 discord.com 9 discord.com -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2764 Client-built.exe Token: SeDebugPrivilege 2220 taskmgr.exe Token: SeSystemProfilePrivilege 2220 taskmgr.exe Token: SeCreateGlobalPrivilege 2220 taskmgr.exe Token: 33 2220 taskmgr.exe Token: SeIncBasePriorityPrivilege 2220 taskmgr.exe -
Suspicious use of FindShellTrayWindow 40 IoCs
pid Process 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe -
Suspicious use of SendNotifyMessage 40 IoCs
pid Process 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe 2220 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2764
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2220