Analysis
-
max time kernel
299s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03-09-2024 14:42
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
8 signatures
300 seconds
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
51fb0b8fd09f1011e3e049c86d08c94a
-
SHA1
4fb4616ad94fccb2aa2991520d32f19b3b72a59f
-
SHA256
408f0f6aeea0e955ae90664a025a53943c15387d7543c2071233c55837406dd5
-
SHA512
1f71e4300c5afc50e2c859bde953da25ff3490680fee81c07a176aecadb0bb2a1cdf3840e77d78f75cf6195e089365789631783c5ab7dc6067d7bb470877c1bd
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+5PIC:5Zv5PDwbjNrmAE+JIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI4MDUzMjExMjIyMjU4ODk3OA.GY5-Aq.aEjcBIZFVoow9YiOolcbOLThpN78hMzm_mea_s
-
server_id
1255189717742256160
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1932 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2388 Client-built.exe Token: SeDebugPrivilege 1932 taskmgr.exe Token: SeSystemProfilePrivilege 1932 taskmgr.exe Token: SeCreateGlobalPrivilege 1932 taskmgr.exe Token: SeDebugPrivilege 532 Client-built.exe Token: SeDebugPrivilege 4368 Client-built.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe 1932 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2388
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1932
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:532
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4368