discordrat | hxxps://mega[.]nz/file/1BBCyKKR#0BcXNMbdW1r2fsggeRP4xvvq6yXd_ftr7wOQEcDIp_Y

Analysis

max time kernel
95s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25-08-2024 15:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/file/1BBCyKKR#0BcXNMbdW1r2fsggeRP4xvvq6yXd_ftr7wOQEcDIp_Y

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTI3NzI3ODc1MTMxNDY3Nzg2Mw.GKptwK.6ttTGh-Su92JyjNbovqY4JTGfOdndadlxBfGrE
server_id
1277277846360031292

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Executes dropped EXE 53 IoCs

pid	Process
6064	Client-built.exe
5312	Client-built.exe
5796	Client-built.exe
212	Client-built.exe
6000	Client-built.exe
5332	Client-built.exe
5940	Client-built.exe
5892	Client-built.exe
3028	Client-built.exe
1004	Client-built.exe
5372	Client-built.exe
5552	Client-built.exe
2936	Client-built.exe
4288	Client-built.exe
1696	Client-built.exe
4496	Client-built.exe
5512	Client-built.exe
5636	Client-built.exe
3876	Client-built.exe
5420	Client-built.exe
1856	Client-built.exe
4060	Client-built.exe
4940	Client-built.exe
6216	Client-built.exe
6260	Client-built.exe
6348	Client-built.exe
6356	Client-built.exe
6384	Client-built.exe
6416	Client-built.exe
6484	Client-built.exe
6520	Client-built.exe
6548	Client-built.exe
6556	Client-built.exe
6640	Client-built.exe
6664	Client-built.exe
6708	Client-built.exe
6716	Client-built.exe
6740	Client-built.exe
6760	Client-built.exe
6864	Client-built.exe
6980	Client-built.exe
7012	Client-built.exe
7032	Client-built.exe
7052	Client-built.exe
7060	Client-built.exe
7076	Client-built.exe
6088	Client-built.exe
4100	Client-built.exe
6164	Client-built.exe
6596	Client-built.exe
7024	Client-built.exe
7448	Client-built.exe
7612	Client-built.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
72	discord.com
74	discord.com
81	discord.com
86	discord.com
141	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 99880.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe
3740	msedge.exe
3740	msedge.exe
1848	identity_helper.exe
1848	identity_helper.exe
5944	msedge.exe
5944	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe

Suspicious use of AdjustPrivilegeToken 55 IoCs

description	pid	Process
Token: 33	5464	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5464	AUDIODG.EXE
Token: SeDebugPrivilege	6064	Client-built.exe
Token: SeDebugPrivilege	5312	Client-built.exe
Token: SeDebugPrivilege	5796	Client-built.exe
Token: SeDebugPrivilege	212	Client-built.exe
Token: SeDebugPrivilege	6000	Client-built.exe
Token: SeDebugPrivilege	5332	Client-built.exe
Token: SeDebugPrivilege	5940	Client-built.exe
Token: SeDebugPrivilege	5892	Client-built.exe
Token: SeDebugPrivilege	5372	Client-built.exe
Token: SeDebugPrivilege	3028	Client-built.exe
Token: SeDebugPrivilege	1004	Client-built.exe
Token: SeDebugPrivilege	5552	Client-built.exe
Token: SeDebugPrivilege	4288	Client-built.exe
Token: SeDebugPrivilege	2936	Client-built.exe
Token: SeDebugPrivilege	4496	Client-built.exe
Token: SeDebugPrivilege	3876	Client-built.exe
Token: SeDebugPrivilege	5636	Client-built.exe
Token: SeDebugPrivilege	5512	Client-built.exe
Token: SeDebugPrivilege	5420	Client-built.exe
Token: SeDebugPrivilege	1696	Client-built.exe
Token: SeDebugPrivilege	6260	Client-built.exe
Token: SeDebugPrivilege	4060	Client-built.exe
Token: SeDebugPrivilege	6216	Client-built.exe
Token: SeDebugPrivilege	4940	Client-built.exe
Token: SeDebugPrivilege	1856	Client-built.exe
Token: SeDebugPrivilege	6484	Client-built.exe
Token: SeDebugPrivilege	6520	Client-built.exe
Token: SeDebugPrivilege	6356	Client-built.exe
Token: SeDebugPrivilege	6348	Client-built.exe
Token: SeDebugPrivilege	6384	Client-built.exe
Token: SeDebugPrivilege	6716	Client-built.exe
Token: SeDebugPrivilege	6760	Client-built.exe
Token: SeDebugPrivilege	6740	Client-built.exe
Token: SeDebugPrivilege	6664	Client-built.exe
Token: SeDebugPrivilege	6864	Client-built.exe
Token: SeDebugPrivilege	6416	Client-built.exe
Token: SeDebugPrivilege	6980	Client-built.exe
Token: SeDebugPrivilege	7024	Client-built.exe
Token: SeDebugPrivilege	7012	Client-built.exe
Token: SeDebugPrivilege	6640	Client-built.exe
Token: SeDebugPrivilege	6548	Client-built.exe
Token: SeDebugPrivilege	6556	Client-built.exe
Token: SeDebugPrivilege	6088	Client-built.exe
Token: SeDebugPrivilege	7076	Client-built.exe
Token: SeDebugPrivilege	6596	Client-built.exe
Token: SeDebugPrivilege	6164	Client-built.exe
Token: SeDebugPrivilege	6708	Client-built.exe
Token: SeDebugPrivilege	7060	Client-built.exe
Token: SeDebugPrivilege	7052	Client-built.exe
Token: SeDebugPrivilege	4100	Client-built.exe
Token: SeDebugPrivilege	7612	Client-built.exe
Token: SeDebugPrivilege	7032	Client-built.exe
Token: SeDebugPrivilege	7448	Client-built.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3740 wrote to memory of 440	3740	msedge.exe	86
PID 3740 wrote to memory of 440	3740	msedge.exe	86
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 2156	3740	msedge.exe	87
PID 3740 wrote to memory of 3544	3740	msedge.exe	88
PID 3740 wrote to memory of 3544	3740	msedge.exe	88
PID 3740 wrote to memory of 712	3740	msedge.exe	89
PID 3740 wrote to memory of 712	3740	msedge.exe	89
PID 3740 wrote to memory of 712	3740	msedge.exe	89
PID 3740 wrote to memory of 712	3740	msedge.exe	89
PID 3740 wrote to memory of 712	3740	msedge.exe	89
PID 3740 wrote to memory of 712	3740	msedge.exe	89
PID 3740 wrote to memory of 712	3740	msedge.exe	89
PID 3740 wrote to memory of 712	3740	msedge.exe	89
PID 3740 wrote to memory of 712	3740	msedge.exe	89
PID 3740 wrote to memory of 712	3740	msedge.exe	89
PID 3740 wrote to memory of 712	3740	msedge.exe	89
PID 3740 wrote to memory of 712	3740	msedge.exe	89
PID 3740 wrote to memory of 712	3740	msedge.exe	89
PID 3740 wrote to memory of 712	3740	msedge.exe	89
PID 3740 wrote to memory of 712	3740	msedge.exe	89
PID 3740 wrote to memory of 712	3740	msedge.exe	89
PID 3740 wrote to memory of 712	3740	msedge.exe	89
PID 3740 wrote to memory of 712	3740	msedge.exe	89
PID 3740 wrote to memory of 712	3740	msedge.exe	89
PID 3740 wrote to memory of 712	3740	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/1BBCyKKR#0BcXNMbdW1r2fsggeRP4xvvq6yXd_ftr7wOQEcDIp_Y
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80c1846f8,0x7ff80c184708,0x7ff80c184718
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,7564465124910266658,13608222637112692230,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,7564465124910266658,13608222637112692230,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,7564465124910266658,13608222637112692230,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7564465124910266658,13608222637112692230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7564465124910266658,13608222637112692230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,7564465124910266658,13608222637112692230,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,7564465124910266658,13608222637112692230,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7564465124910266658,13608222637112692230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7564465124910266658,13608222637112692230,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7564465124910266658,13608222637112692230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7564465124910266658,13608222637112692230,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2120,7564465124910266658,13608222637112692230,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,7564465124910266658,13608222637112692230,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7564465124910266658,13608222637112692230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2120,7564465124910266658,13608222637112692230,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,7564465124910266658,13608222637112692230,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5944
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6064
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5312
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5796
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:212
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6000
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5332
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5940
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5892
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3028
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5372
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1004
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5552
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2936
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4288
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1696
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4496
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5512
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5636
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3876
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5420
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1856
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4060
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4940
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6216
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6260
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6348
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6356
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6384
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6416
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6484
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6520
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6548
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6556
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6640
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6664
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6708
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6716
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6740
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6760
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6864
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6980
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:7012
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:7024
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:7032
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:7052
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:7060
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:7076
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6164
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6088
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4100
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6596
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:7448
- C:\Users\Admin\Downloads\Client-built.exe
  "C:\Users\Admin\Downloads\Client-built.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:7612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1260

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x150 0x2f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5464

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:9792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
80b596d555cbbee711fa0e4ac5a0447f

SHA1
dc2b417271137774aa2c8498d334a63bd2293a0e

SHA256
ff5fded28e572f3b296f02f6c660fa72a652ee570d7c81552a95b11c4b9605db

SHA512
0b07b7202f5210fec6803a32bfc95c0b60809bac67ffbf71dc130f045bdb20318ab568a790d82aa3e04f24f7358e4edf81251a38f6c84c175dde830d5ca9f0f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
188B

MD5
008114e1a1a614b35e8a7515da0f3783

SHA1
3c390d38126c7328a8d7e4a72d5848ac9f96549b

SHA256
7301b76033c2970e61bab5eaddaff5aa652c39db5c0ea5632814f989716a1d18

SHA512
a202fc891eace003c346bad7e5d2c73dadf9591d5ce950395ff4b63cc2866b17e02bd3f0ad92749df033a936685851455bcdbfad30f26e765c3c89d3309cb82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eac73b660f1908e898998ab58dd84ffc

SHA1
82678eb62c7a86d9da73e0a83ca830badc7b7eb0

SHA256
35f87f4843481c3b06ed6ddae5400cb408551a88e916d5acfba24c3ebe27e441

SHA512
91c16b2167cf019851dcd308313e464dfdb17183f861c45e95a52b5a7bc96b844006f5165dd7aa0b57e8e9f6a219b75f813901e4da97511bd4530a819fb97834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6d6f3352cf0d624dd3cec08e22396754

SHA1
7cc82faf343a74c63765ee3c3267fc9738eef629

SHA256
a82658b37a331692c13760d5e98a518847ffe1898654c4999e3439c8f9a76210

SHA512
16cf461d7b88a0cf935f8faee5ac0bec510fd1565a32968168a06c52d4cd35a411ba0d14742ed4c73a2f154e23af94dd340ae8d755ab54342c2d9766b265fa51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
76a8606c873bf318ea72a6314ad864e8

SHA1
4dab7b1c013241d6b37eb71a66266d4f81d6773c

SHA256
953fdd1f1e3f36634172c603ba961aa7f0f9d35ea0e6736f601975516eb244d7

SHA512
c6dca26b91650afa2f1779f687149fae932db83bb7cb1e86771545990ccf0c0aef759b75942668a0b46b69fb4619b93e1c8f470964e115245df7391438e9c285

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
ef3366c56b11e42a6437159ab18a3130

SHA1
b240ea150e38d11892c2be00759d5c77de1a685a

SHA256
2169ce9bc2ea984842a8c08a3ea27137c0a7b7052efdbeeabed07708bbc8575f

SHA512
5f949b264825bfb50fe4ea472ab60f8b5a4b1a67d6bc25cbd11d41c2cdbdbbe1e5daf9ffd517c3a185e2ddb380b7b78fbe1d5100c3a9d032552d078590abb17d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57e177.TMP

Filesize
48B

MD5
cfb42504c184105e840e075d7a605da3

SHA1
c20e253be38fd3cf6442a40214997336a2839bf6

SHA256
cb5f0483ccf8d5d89d4a0a0a9c320e9bac372f43c8b278629643ef65bdd4110e

SHA512
277a0e6c019fadaf6d1051c42c1177dd61c06c4a79eba875714365412b87e583957503140c8f81271d0af211a331646b39bf78738e2ac41d3237cbb6b25033f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
24222323bb4586d59026067fdda54f19

SHA1
4cef7b48dfbf8efe6a5d2b5331d3c06ed1e2719b

SHA256
da8c39c65666ad86a1097df2e7ce979a54dabc5ff0a179f7a49469278f75547b

SHA512
03283f660da554899ccc28aaffd04b3702b579f743a48ebe336a5139c6486bf48548c618f664e4b3f0c6a0419ff5a714cac01e4be584263315c3f0bd3aca29dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
695ab27ddd5632f29f75b748856c7574

SHA1
a2ac4cd1e019dccc6b6fd2b2ac893fc1147a69dc

SHA256
38e5ee9affaa2911559c992c9a6fdaa264e4fea41bc78ef167a1f634fd37d1d0

SHA512
9e570745b3f404c10800c1de7505b2f3dbfbd8e50ea742c9f25e7664ed7269ab30321f27d3562442e1ef1eba9e300adb238ba85655b1e4753f24e47fb02c3f10

Download Submit
C:\Users\Admin\Downloads\Client-built.exe

Filesize
78KB

MD5
ff847e46cf128da78fd77a9e977e6419

SHA1
37d08015addba8cc4b7764d15b0f20416aa8da98

SHA256
c9f8cec5acf6448bf61584f9f04a477ec2af9f0e4ee4e79170b0ba7ce50da7b3

SHA512
6ccc3e14e7aeefb54d58b79428ee53601414b880ccff24673faa36311b4b9ee3aaf8c1b1b795e85e43d1a69f2876584889c122d4c9e1599244b2fbd04dd66fe0

Download Submit
memory/6064-205-0x000001D818A40000-0x000001D818A58000-memory.dmp

Filesize
96KB

Download
memory/6064-206-0x000001D833170000-0x000001D833332000-memory.dmp

Filesize
1.8MB

Download
memory/6064-207-0x000001D8339B0000-0x000001D833ED8000-memory.dmp

Filesize
5.2MB

Download