Analysis
-
max time kernel
79s -
max time network
74s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
09-09-2024 22:20
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win11-20240802-en
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
bd8aa548c282f2156b940c67f212a196
-
SHA1
5c76d556322dd933ae1e0304a3667e2121bed0c4
-
SHA256
b39337904af234ce5ab04051a009b9a8c60fa46bccc76d449800be886c123e0b
-
SHA512
976930e1551958cf9469b4bad2c6b52f1844ef8c303d4182d6486a7ed09f11ecff0ae1433031d44e466f24944a6a5101148268f370c5a76f62d606e79a34e685
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+HPIC:5Zv5PDwbjNrmAE+vIC
Malware Config
Extracted
discordrat
-
discord_token
MTI4MjgyNzA4MTIyMjE5NzI1OA.GYGKGD._ZCToapQCVB6uJoewAZmBanGCE2C92HCs5RwD0
-
server_id
1282683459751510098
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
Client-built.exedescription pid process target process PID 1356 created 636 1356 Client-built.exe winlogon.exe -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx svchost.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs
Processes:
flow ioc 3 discord.com 5 discord.com 8 discord.com 11 discord.com 1 discord.com 1 raw.githubusercontent.com 7 raw.githubusercontent.com 9 raw.githubusercontent.com 10 discord.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Client-built.exedescription pid process target process PID 1356 set thread context of 644 1356 Client-built.exe dllhost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Client-built.exedllhost.exepid process 1356 Client-built.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 1356 Client-built.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 1356 Client-built.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 1356 Client-built.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 1356 Client-built.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 1356 Client-built.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 644 dllhost.exe 1356 Client-built.exe 644 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
Client-built.exedllhost.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1356 Client-built.exe Token: SeDebugPrivilege 1356 Client-built.exe Token: SeDebugPrivilege 644 dllhost.exe Token: SeShutdownPrivilege 3360 Explorer.EXE Token: SeCreatePagefilePrivilege 3360 Explorer.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Client-built.exedllhost.exedescription pid process target process PID 1356 wrote to memory of 644 1356 Client-built.exe dllhost.exe PID 1356 wrote to memory of 644 1356 Client-built.exe dllhost.exe PID 1356 wrote to memory of 644 1356 Client-built.exe dllhost.exe PID 1356 wrote to memory of 644 1356 Client-built.exe dllhost.exe PID 1356 wrote to memory of 644 1356 Client-built.exe dllhost.exe PID 1356 wrote to memory of 644 1356 Client-built.exe dllhost.exe PID 1356 wrote to memory of 644 1356 Client-built.exe dllhost.exe PID 1356 wrote to memory of 644 1356 Client-built.exe dllhost.exe PID 1356 wrote to memory of 644 1356 Client-built.exe dllhost.exe PID 1356 wrote to memory of 644 1356 Client-built.exe dllhost.exe PID 1356 wrote to memory of 644 1356 Client-built.exe dllhost.exe PID 644 wrote to memory of 636 644 dllhost.exe winlogon.exe PID 644 wrote to memory of 688 644 dllhost.exe lsass.exe PID 644 wrote to memory of 984 644 dllhost.exe svchost.exe PID 644 wrote to memory of 476 644 dllhost.exe dwm.exe PID 644 wrote to memory of 1036 644 dllhost.exe svchost.exe PID 644 wrote to memory of 1060 644 dllhost.exe svchost.exe PID 644 wrote to memory of 1068 644 dllhost.exe svchost.exe PID 644 wrote to memory of 1156 644 dllhost.exe svchost.exe PID 644 wrote to memory of 1192 644 dllhost.exe svchost.exe PID 644 wrote to memory of 1308 644 dllhost.exe svchost.exe PID 644 wrote to memory of 1348 644 dllhost.exe svchost.exe PID 644 wrote to memory of 1408 644 dllhost.exe svchost.exe PID 644 wrote to memory of 1424 644 dllhost.exe svchost.exe PID 644 wrote to memory of 1456 644 dllhost.exe svchost.exe PID 644 wrote to memory of 1484 644 dllhost.exe svchost.exe PID 644 wrote to memory of 1580 644 dllhost.exe svchost.exe PID 644 wrote to memory of 1616 644 dllhost.exe svchost.exe PID 644 wrote to memory of 1672 644 dllhost.exe svchost.exe PID 644 wrote to memory of 1684 644 dllhost.exe svchost.exe PID 644 wrote to memory of 1796 644 dllhost.exe svchost.exe PID 644 wrote to memory of 1820 644 dllhost.exe svchost.exe PID 644 wrote to memory of 1864 644 dllhost.exe svchost.exe PID 644 wrote to memory of 1872 644 dllhost.exe svchost.exe PID 644 wrote to memory of 1988 644 dllhost.exe svchost.exe PID 644 wrote to memory of 2024 644 dllhost.exe svchost.exe PID 644 wrote to memory of 2052 644 dllhost.exe spoolsv.exe PID 644 wrote to memory of 2184 644 dllhost.exe svchost.exe PID 644 wrote to memory of 2272 644 dllhost.exe svchost.exe PID 644 wrote to memory of 2388 644 dllhost.exe svchost.exe PID 644 wrote to memory of 2396 644 dllhost.exe svchost.exe PID 644 wrote to memory of 2424 644 dllhost.exe svchost.exe PID 644 wrote to memory of 2508 644 dllhost.exe svchost.exe PID 644 wrote to memory of 2548 644 dllhost.exe sysmon.exe PID 644 wrote to memory of 2576 644 dllhost.exe svchost.exe PID 644 wrote to memory of 2584 644 dllhost.exe svchost.exe PID 644 wrote to memory of 2616 644 dllhost.exe svchost.exe PID 644 wrote to memory of 2624 644 dllhost.exe svchost.exe PID 644 wrote to memory of 2316 644 dllhost.exe sihost.exe PID 644 wrote to memory of 2640 644 dllhost.exe svchost.exe PID 644 wrote to memory of 2608 644 dllhost.exe unsecapp.exe PID 644 wrote to memory of 3360 644 dllhost.exe Explorer.EXE PID 644 wrote to memory of 3492 644 dllhost.exe svchost.exe PID 644 wrote to memory of 3532 644 dllhost.exe svchost.exe PID 644 wrote to memory of 3912 644 dllhost.exe RuntimeBroker.exe PID 644 wrote to memory of 4024 644 dllhost.exe RuntimeBroker.exe PID 644 wrote to memory of 4088 644 dllhost.exe svchost.exe PID 644 wrote to memory of 3596 644 dllhost.exe DllHost.exe PID 644 wrote to memory of 4320 644 dllhost.exe DllHost.exe PID 644 wrote to memory of 4576 644 dllhost.exe svchost.exe PID 644 wrote to memory of 4312 644 dllhost.exe svchost.exe PID 644 wrote to memory of 4988 644 dllhost.exe svchost.exe PID 644 wrote to memory of 1948 644 dllhost.exe svchost.exe PID 644 wrote to memory of 1232 644 dllhost.exe svchost.exe
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:636
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:476
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{b15c098a-0de5-4fc8-b599-1658c6219cdf}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:644
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:688
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:984
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1036
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1060
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:1068
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1156
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netprofm -p -s netprofm1⤵PID:1192
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1308
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1348
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:1408
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1424
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1456
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1484
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1580
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1616
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵PID:1672
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1684
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1796
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1820
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1864
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1872
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:1988
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:2024
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2052
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2184
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:2272
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2316
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2388
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2396
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵PID:2424
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2508
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2548
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2576
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2584
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:2616
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2624
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2640
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:2608
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1356
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3492
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵PID:3532
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3912
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4024
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵PID:4088
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3596
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵PID:4320
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc1⤵PID:4576
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:4312
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:4988
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:1948
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:1232
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:4048
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵PID:2504
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:2612
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1656
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵PID:2908