Analysis
-
max time kernel
149s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
15-08-2024 12:04
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240729-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Client-built.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
8156ccc10bc5c1f7ba69b450863f80b6
-
SHA1
93d4dc689026e4ae3f90436b4761d3cf5e5e9ac8
-
SHA256
3df56b170bc3939db11caf42589764b2fc4665378bf3167680a32ae09fc4928b
-
SHA512
9ea925180774e406a6ef514e61950b1361fb917b47810f6b13c0330cb8167a62060b74dfc64206daeec8ac00dff3cdbdd55cebdc6ba14bb8e11d715e67665004
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+yPIC:5Zv5PDwbjNrmAE++IC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI3MzYxMjMzOTIzMjM3NDgxNQ.GQcb7R.nEBZJ0-xqAtaQmaz1po2HsTsPCGl9hphGbXGvo
-
server_id
1273612222693642371
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3100 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3516 Client-built.exe Token: SeManageVolumePrivilege 4612 svchost.exe Token: SeDebugPrivilege 3100 taskmgr.exe Token: SeSystemProfilePrivilege 3100 taskmgr.exe Token: SeCreateGlobalPrivilege 3100 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe 3100 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3516
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4612
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3100
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1776
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD5c712ca1d2f714b97b0c33fdd76da562c
SHA1f6dae5e4ba9eef6ca5c778f596db611659d2d57c
SHA256f13f73a7b65bc068cdfe35d222b782b8606b857dd6796216a0081141bc65dcf0
SHA512f874f9bda5dbb481f9175c164bef34b4eb9575f604ba9b164ed25a14be982c19e487d535fb4495da70e7d5eb42ca118339fc69055cf8277ca7f6c13d15c4725d