discordrat | hxxps://github[.]com/ayfe3w/server-nuker

Analysis

max time kernel
334s
max time network
335s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-08-2024 22:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/ayfe3w/server-nuker

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
2
server_id
12512312312512312312

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Executes dropped EXE 1 IoCs

pid	Process
2848	Client-built.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-355097885-2402257403-2971294179-1000\{BCE526CC-E4EA-4211-9C22-82DF8DF2C945}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2884	msedge.exe
2884	msedge.exe
864	msedge.exe
864	msedge.exe
2692	identity_helper.exe
2692	identity_helper.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
2020	msedge.exe
1056	msedge.exe
1056	msedge.exe
4272	msedge.exe
4272	msedge.exe
4996	msedge.exe
4996	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2252	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2848	Client-built.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
2252	OpenWith.exe
2252	OpenWith.exe
2252	OpenWith.exe
2252	OpenWith.exe
2252	OpenWith.exe
2252	OpenWith.exe
2252	OpenWith.exe
2252	OpenWith.exe
2252	OpenWith.exe
2252	OpenWith.exe
2252	OpenWith.exe
2252	OpenWith.exe
2252	OpenWith.exe
2252	OpenWith.exe
2252	OpenWith.exe
2252	OpenWith.exe
2252	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 2904	864	msedge.exe	84
PID 864 wrote to memory of 2904	864	msedge.exe	84
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 5036	864	msedge.exe	85
PID 864 wrote to memory of 2884	864	msedge.exe	86
PID 864 wrote to memory of 2884	864	msedge.exe	86
PID 864 wrote to memory of 5112	864	msedge.exe	87
PID 864 wrote to memory of 5112	864	msedge.exe	87
PID 864 wrote to memory of 5112	864	msedge.exe	87
PID 864 wrote to memory of 5112	864	msedge.exe	87
PID 864 wrote to memory of 5112	864	msedge.exe	87
PID 864 wrote to memory of 5112	864	msedge.exe	87
PID 864 wrote to memory of 5112	864	msedge.exe	87
PID 864 wrote to memory of 5112	864	msedge.exe	87
PID 864 wrote to memory of 5112	864	msedge.exe	87
PID 864 wrote to memory of 5112	864	msedge.exe	87
PID 864 wrote to memory of 5112	864	msedge.exe	87
PID 864 wrote to memory of 5112	864	msedge.exe	87
PID 864 wrote to memory of 5112	864	msedge.exe	87
PID 864 wrote to memory of 5112	864	msedge.exe	87
PID 864 wrote to memory of 5112	864	msedge.exe	87
PID 864 wrote to memory of 5112	864	msedge.exe	87
PID 864 wrote to memory of 5112	864	msedge.exe	87
PID 864 wrote to memory of 5112	864	msedge.exe	87
PID 864 wrote to memory of 5112	864	msedge.exe	87
PID 864 wrote to memory of 5112	864	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/ayfe3w/server-nuker
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa50b46f8,0x7fffa50b4708,0x7fffa50b4718
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7190102151454178236,7689655275632982349,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,7190102151454178236,7689655275632982349,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,7190102151454178236,7689655275632982349,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7190102151454178236,7689655275632982349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7190102151454178236,7689655275632982349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7190102151454178236,7689655275632982349,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7190102151454178236,7689655275632982349,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7190102151454178236,7689655275632982349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7190102151454178236,7689655275632982349,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7190102151454178236,7689655275632982349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7190102151454178236,7689655275632982349,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7190102151454178236,7689655275632982349,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3008 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7190102151454178236,7689655275632982349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1572 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7190102151454178236,7689655275632982349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2100,7190102151454178236,7689655275632982349,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1464 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2100,7190102151454178236,7689655275632982349,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3192 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7190102151454178236,7689655275632982349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7190102151454178236,7689655275632982349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1872 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7190102151454178236,7689655275632982349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7190102151454178236,7689655275632982349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,7190102151454178236,7689655275632982349,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,7190102151454178236,7689655275632982349,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6540 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7190102151454178236,7689655275632982349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,7190102151454178236,7689655275632982349,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7190102151454178236,7689655275632982349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6924 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7190102151454178236,7689655275632982349,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7190102151454178236,7689655275632982349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7190102151454178236,7689655275632982349,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6704 /prefetch:1
  2⤵
  PID:2328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2476

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4456

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2252
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Discord-RAT-2.0-master.zip\Discord-RAT-2.0-master\README.md
  2⤵
  PID:4140

C:\Users\Admin\Downloads\release\builder.exe
"C:\Users\Admin\Downloads\release\builder.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:60

C:\Users\Admin\Downloads\release\Client-built.exe
"C:\Users\Admin\Downloads\release\Client-built.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\02b5923a-1598-4952-8581-fb99dd17e963.tmp

Filesize
1KB

MD5
fd5116dd37260a68d774149ad677e53d

SHA1
d7121df6bf3f2337a924677a76850e43d7f0faf2

SHA256
56053d84ed1d1a4de5a2c8745341bd6393b3b14f78cd5bdb7b09b8263babaf3f

SHA512
52f25f4934084da43adaddfbfc7902307c07a2b47c8004605adcf67e7503d40279fd2c3dddc358ade8d1b170adc8866c03c3d3e3ec2ed676061f5464557c1324

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
4KB

MD5
1cc6e90ee01a3c4aa3a210791acb23cc

SHA1
419fd9f045a8a8d15bcf633b9e3e68713ad2c35f

SHA256
9000d17ef8f194caf91ca785ed05df6b4ea7831e63f089233ec934369e149b43

SHA512
41beb31d6af4168ab86289a1aa843495ceea0564ece59cc4e50635e26e8f3ec7454b88ffb3edbe1d78bd31a635d14037450afe2062470e0966f0972a78041a0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
60e031b45dd6ca606be94815ca998773

SHA1
11e9f39717fda5f4087c89e74f10a24570f344f2

SHA256
44535539830fe816346725bc34fe6d32980077b1565aab3b72031381f4d158c4

SHA512
3300f559a7cf9da54aabb5a93f9017e300d434ed9e9a91d0066014472a8d0b307887aba4e9632906a346ed4d0e93ea6caa1b6753d05c0e8190ef918232a2c8b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
409B

MD5
5fc4e74c4d38bba219819f874c0113be

SHA1
a3fb5b9020c46ed9101423f7dd81d335aec02bb9

SHA256
19b94f1cee30d5c9c2c0c15572c39aeace2842405c906faaf5b2c7ba7b34e910

SHA512
b5625e4761ee52e339b9638d0d80db992fbce3552dd6574573d9c16e161c124177c8f5b1bdc70a78d82a252630dd73054179f73645a1d6954425daf9f01d6575

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
942B

MD5
cb2604d86334c887158deaa41759d6c7

SHA1
a6bbe62921c1c02067884eb9a8e19bbec335ddfb

SHA256
2898efd8e3d34cd42ebb960de6cdf31d286f2b391db975aa7590518be877ab41

SHA512
f4809b417efcd16f66d8b80ee747cd84e714f51b373220d12272f43a864f9aef61016ca9da71379af128181b190dbbc19d84f99bfa1d3911e22ac15e58ccd953

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
228cca7d4b47ffe89e40755f06c13461

SHA1
5b0bbd88e0d71981c248a658bf5f7990864860e6

SHA256
ab909405b44cc7202c698f6b9e2e6dc858b90359d49a83ffed3aabaa3480e25c

SHA512
1811e5534aafcd8ec0f97e5661bf0be3f94a6fcfb5dcaa907a715cf62eef94170f07ea3e81bc796fe33310a24bfa38195e7a4bf874c659365c357a3368e12bd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
61810db776e39e4e15346f49542c32dc

SHA1
e51dd4b6e693999dc6d3112a03b1aeec99103a0a

SHA256
0304650f3729e411c18d83ab08c1c3494cb9f5208b29d91c76bc2ca89ec517e2

SHA512
0dc6550f8d4ff7eec334f641dbf36bbcdab0ab9faf21d70009133a08a3152112de3e34985907c09386f009ca046b0487edb58c63215f2fa60415f45e0dea595c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c1203070782fe569ef799a2235951495

SHA1
2da613eb9d000b3513479b9678397c58899e0cf8

SHA256
bfb3a442b060a7e5b53f27d2bfa26a6f29ada4f4843e68261a0d5054880eff3f

SHA512
a54f4badbc89ce349073264bd0c6b955f0fb3e36090beef31912ebf344d3d6e18521ee7497edfca7cff13ce81294a6d186bfd7062912465c822d2649ac36b9fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c259c223dce98895f41516a69ee5e4b4

SHA1
6bbd84a7097edc0637ea5769e6556acbdc06dd90

SHA256
e1be71c8a70225abc2f3a0a934c60bb68fab2d176dff0e50d13c570580139f60

SHA512
456dd1094b8dc4d872ed7d78ea795b251d59fe4d04eba6dff42e288d470e364227d8e8361ff428978fcbce578771c061dc5d5df9388af3c3c0df6ead0b3b2af9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9a5588ddcf72e52b3b308ede2b81ae48

SHA1
d4eddf65eebaa632ce73c3d57a528e515953fcae

SHA256
ebcaa88292e8354c2dc79d6e6b00712682c4100e2526d315b803fc4b60e52e2d

SHA512
8a11b93934c5522c7bb4b30ca0a69545f981034c97b80d230cc5873c9de765bf3619dcf0ab0e846ffb5e399c9e518f4a18149572b1759cbc94b7fdbc4737286d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4b0ac1cc75806cb3bbd3897d7b0185b0

SHA1
04cc240e804a2c249e624c3f45dfc8460586f29b

SHA256
e90747794947837778537713a03286bc19bfe87cfe2de09540ee111a6bf07462

SHA512
919abb6cf33ccd8f3e3893b5240c37421f606271ab5288cdb3735b706d00f6fd8d4a27ac1ce7a56df331058fef4118affd98769dced23fa07f54b0ba0148fb65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3e24b7c41d962f534779721cfb8371bb

SHA1
16c681d8e47362f376a44e524cfe59be3ce159b4

SHA256
a807ecc021b7edffdaa305f6644b56c39ac560cd42a7255df7ec26e7894170aa

SHA512
54163198ed1ecf9c4bd1c046ac4bfb20c2da23494664be5bd18ff79f712dc01f84bef9b5b1eff00167e99f3965c0c50a2b9d7f5a1f877b8dab40f98002fe1c81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59ad7c.TMP

Filesize
706B

MD5
0fab5ce3851b608bd92c0809963ed53c

SHA1
905f3624d64cb5dea14ea7a7dafee8c53d07fa7a

SHA256
b309e4cb42beb94dd2939088be154a4e89a13325f2fa0b150d01e8c50724e6b9

SHA512
89a60ab5f8c4e1c93d7f0d4c43c349097aab7cd197888c0e4e77be1e6ce2203d65fa6ec5da6507c570f6a7cfe6fda628478df0ddab5737238101148a0a243355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
926a422bfd654523f3e177cd8822d861

SHA1
47cbeb75829a5e1704c42635c3e2620ed851fc42

SHA256
30718adecff6aa54c02362bfd071a79d042a40579d54ba04471e7236c4469926

SHA512
4986901f8ce83232dbd3d760d3939dcc86ca93b564ed34e1684ed8e28c61f3e592d7af5a7aa1f79b16ed44305222552bc6a34f46ef954ae1600c763e81b7d283

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
e27e6820326d77b201f56411f9946587

SHA1
5de9081b12cea773d1430f91bebc61e9f8fdfdcb

SHA256
9332fc3f1894740eeb2c8cb5758f10d6b956d7a4a491c7109cc4410ed42b2169

SHA512
8fb10a2ac74f7eb250c61df20763fa11f2665937a06d1fabf9c39a5f56b21b14e4172f5583d52183dba738870c4724608c1b56fff535163c1119e60ead320b31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
57ecc047195bb6b64fb383413eb3d44d

SHA1
5e7f4de0e1fc6d295dd600a0682819f262e458eb

SHA256
ea000ca5ae2bf22673e3d3a9e826a2d98a61a769b8c8749e66852dc6ebabf077

SHA512
12a88e8df72a1b1a92a10dee8e1928f94d11a4fd04659a8870a581f338e1b2ce4ca223495c06d5b5f9060e6372855778a12abe9c474cfd688c75ef2ac8fc73b8

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 271206.crdownload

Filesize
12.1MB

MD5
017e28cd77905a0bd918d7e725632a2a

SHA1
d709e343f64d93ab00c6fc0aa4ae6ab22aec9f73

SHA256
c8de0e92e603214114f8800dd99ecf8cb69ac85caf8010a99ba3f66afe70fcbf

SHA512
0ae6f1dea994d879043b0ef63049cdbd68dd7671b1df53f3688e91a7027dde8de6d193bafeb12f4c6b7f97909d116f06811a29d13c56ada2c774e78dcc5f1a16

Download Submit
C:\Users\Admin\Downloads\release.zip

Filesize
445KB

MD5
06a4fcd5eb3a39d7f50a0709de9900db

SHA1
50d089e915f69313a5187569cda4e6dec2d55ca7

SHA256
c13a0cd7c2c2fd577703bff026b72ed81b51266afa047328c8ff1c4a4d965c97

SHA512
75e5f637fd3282d088b1c0c1efd0de8a128f681e4ac66d6303d205471fe68b4fbf0356a21d803aff2cca6def455abad8619fedc8c7d51e574640eda0df561f9b

Download Submit
C:\Users\Admin\Downloads\release\Client-built.exe

Filesize
78KB

MD5
668b845a3cbf0eceb9cd768d64758dd4

SHA1
f95273f8652709edbd2378e464152688c8e5933f

SHA256
73d965042397065f1cd37c908a8ceacc78773183e0fb8968fa5d71742187df12

SHA512
abe9fa2ea6e321dd34a310e20ead94bbb000faf4d1e755b041526abb10e4df789094e59be5e50330e1e9aca142ffca054586cf99b0a60a8bedc49c539394cf8a

Download Submit
memory/60-673-0x0000000005AC0000-0x0000000006064000-memory.dmp

Filesize
5.6MB

Download
memory/60-674-0x0000000005440000-0x00000000054D2000-memory.dmp

Filesize
584KB

Download
memory/60-675-0x0000000005620000-0x000000000562A000-memory.dmp

Filesize
40KB

Download
memory/60-691-0x0000000008AC0000-0x0000000008BE2000-memory.dmp

Filesize
1.1MB

Download
memory/60-672-0x0000000000BB0000-0x0000000000BB8000-memory.dmp

Filesize
32KB

Download
memory/2848-696-0x0000016E36290000-0x0000016E362A8000-memory.dmp

Filesize
96KB

Download
memory/2848-697-0x0000016E50940000-0x0000016E50B02000-memory.dmp

Filesize
1.8MB

Download
memory/2848-698-0x0000016E51140000-0x0000016E51668000-memory.dmp

Filesize
5.2MB

Download