Analysis Overview
SHA256
c13a0cd7c2c2fd577703bff026b72ed81b51266afa047328c8ff1c4a4d965c97
Threat Level: Known bad
The file release.zip was found to be: Known bad.
Malicious Activity Summary
Discordrat family
Discord RAT
Loads dropped DLL
Executes dropped EXE
Drops file in Windows directory
Unsigned PE
System Location Discovery: System Language Discovery
Uses Task Scheduler COM API
Suspicious use of SendNotifyMessage
Modifies registry class
Suspicious use of FindShellTrayWindow
Checks SCSI registry key(s)
Checks processor information in registry
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-09-12 14:44
Signatures
Discordrat family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2024-09-12 14:44
Reported
2024-09-12 15:01
Platform
win10-20240404-en
Max time kernel
1049s
Max time network
1033s
Command Line
Signatures
Discord RAT
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Client-built.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Client-built.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Client-built.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Client-built.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\rescache\_merged\4183903823\2290032291.pri | C:\Windows\system32\taskmgr.exe | N/A |
| File created | C:\Windows\rescache\_merged\1601268389\715946058.pri | C:\Windows\system32\taskmgr.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\builder.exe | N/A |
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 | C:\Windows\system32\taskmgr.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A | C:\Windows\system32\taskmgr.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName | C:\Windows\system32\taskmgr.exe | N/A |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000_Classes\Local Settings | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\taskmgr.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Mozilla Firefox\firefox.exe | N/A |
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Processes
C:\Users\Admin\AppData\Local\Temp\builder.exe
"C:\Users\Admin\AppData\Local\Temp\builder.exe"
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2740.0.207007564\968619773" -parentBuildID 20221007134813 -prefsHandle 1740 -prefMapHandle 1732 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c87cfaa-57b1-472d-bcaf-a4bff26c216f} 2740 "\\.\pipe\gecko-crash-server-pipe.2740" 1696 239195d2158 gpu
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2740.1.363549066\1489169053" -parentBuildID 20221007134813 -prefsHandle 2136 -prefMapHandle 2132 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {65588e09-2caa-452e-bdbf-76c811927e38} 2740 "\\.\pipe\gecko-crash-server-pipe.2740" 2160 239190e7058 socket
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2740.2.1795260531\890238579" -childID 1 -isForBrowser -prefsHandle 2976 -prefMapHandle 2968 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1028 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2bc41346-809d-4c05-ae25-0526dcff4369} 2740 "\\.\pipe\gecko-crash-server-pipe.2740" 2988 2391955dd58 tab
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2740.3.89500110\391301035" -childID 2 -isForBrowser -prefsHandle 3596 -prefMapHandle 3592 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1028 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {333cf0cd-92fd-4e76-8b60-18754c03f2cc} 2740 "\\.\pipe\gecko-crash-server-pipe.2740" 3604 2391e1b9158 tab
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2740.4.216637692\1475685512" -childID 3 -isForBrowser -prefsHandle 4452 -prefMapHandle 4448 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1028 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9fb89a8e-e672-4d04-bdc4-ab10a9fb64ab} 2740 "\\.\pipe\gecko-crash-server-pipe.2740" 4464 2391f0dfc58 tab
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2740.5.68074109\25586234" -childID 4 -isForBrowser -prefsHandle 4844 -prefMapHandle 4788 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1028 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {91ff7b13-ff19-46ed-b922-1ef2af487380} 2740 "\\.\pipe\gecko-crash-server-pipe.2740" 4816 2391f0df058 tab
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2740.6.1938560759\1361315105" -childID 5 -isForBrowser -prefsHandle 5080 -prefMapHandle 5084 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1028 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {646b8f57-b389-4de8-956f-fe9bf2fc565e} 2740 "\\.\pipe\gecko-crash-server-pipe.2740" 5068 2391f61a558 tab
C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2740.7.1973952865\318634436" -childID 6 -isForBrowser -prefsHandle 5256 -prefMapHandle 5260 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1028 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {58dac354-f8a6-416f-9dc3-bc2a4c18e287} 2740 "\\.\pipe\gecko-crash-server-pipe.2740" 5340 2391fa3f258 tab
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| N/A | 127.0.0.1:49778 | tcp | |
| US | 8.8.8.8:53 | prod.content-signature-chains.prod.webservices.mozgcp.net | udp |
| US | 8.8.8.8:53 | shavar.prod.mozaws.net | udp |
| US | 8.8.8.8:53 | shavar.prod.mozaws.net | udp |
| US | 8.8.8.8:53 | prod.content-signature-chains.prod.webservices.mozgcp.net | udp |
| US | 8.8.8.8:53 | prod.remote-settings.prod.webservices.mozgcp.net | udp |
| US | 8.8.8.8:53 | prod.remote-settings.prod.webservices.mozgcp.net | udp |
| US | 8.8.8.8:53 | 158.124.235.44.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 166.188.117.34.in-addr.arpa | udp |
| N/A | 127.0.0.1:49784 | tcp | |
| US | 8.8.8.8:53 | 77.239.69.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 37.56.20.217.in-addr.arpa | udp |
| US | 8.8.8.8:53 | gateway.discord.gg | udp |
| US | 162.159.130.234:443 | gateway.discord.gg | tcp |
| US | 8.8.8.8:53 | 234.130.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | prod.balrog.prod.cloudops.mozgcp.net | udp |
| US | 8.8.8.8:53 | prod.balrog.prod.cloudops.mozgcp.net | udp |
| US | 8.8.8.8:53 | prod.remote-settings.prod.webservices.mozgcp.net | udp |
| US | 8.8.8.8:53 | prod.remote-settings.prod.webservices.mozgcp.net | udp |
| US | 8.8.8.8:53 | 201.181.244.35.in-addr.arpa | udp |
| US | 8.8.8.8:53 | prod.content-signature-chains.prod.webservices.mozgcp.net | udp |
| US | 8.8.8.8:53 | ciscobinary.openh264.org | udp |
| GB | 88.221.134.155:80 | ciscobinary.openh264.org | tcp |
| US | 8.8.8.8:53 | a19.dscg10.akamai.net | udp |
| US | 8.8.8.8:53 | a19.dscg10.akamai.net | udp |
| US | 8.8.8.8:53 | redirector.gvt1.com | udp |
| US | 8.8.8.8:53 | redirector.gvt1.com | udp |
| GB | 142.250.200.14:443 | redirector.gvt1.com | tcp |
| US | 8.8.8.8:53 | redirector.gvt1.com | udp |
| GB | 142.250.200.14:443 | redirector.gvt1.com | udp |
| US | 8.8.8.8:53 | r2---sn-aigzrnse.gvt1.com | udp |
| GB | 74.125.168.199:443 | r2---sn-aigzrnse.gvt1.com | tcp |
| US | 8.8.8.8:53 | r2.sn-aigzrnse.gvt1.com | udp |
| US | 8.8.8.8:53 | r2.sn-aigzrnse.gvt1.com | udp |
| US | 8.8.8.8:53 | 155.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.200.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 199.168.125.74.in-addr.arpa | udp |
| GB | 74.125.168.199:443 | r2.sn-aigzrnse.gvt1.com | udp |
| US | 8.8.8.8:53 | firefox-settings-attachments.cdn.mozilla.net | udp |
| US | 34.117.121.53:443 | firefox-settings-attachments.cdn.mozilla.net | tcp |
| US | 34.117.121.53:443 | firefox-settings-attachments.cdn.mozilla.net | tcp |
| US | 34.117.121.53:443 | firefox-settings-attachments.cdn.mozilla.net | tcp |
| US | 34.117.121.53:443 | firefox-settings-attachments.cdn.mozilla.net | tcp |
| US | 8.8.8.8:53 | attachments.prod.remote-settings.prod.webservices.mozgcp.net | udp |
| US | 8.8.8.8:53 | attachments.prod.remote-settings.prod.webservices.mozgcp.net | udp |
| US | 162.159.130.234:443 | gateway.discord.gg | tcp |
| US | 8.8.8.8:53 | prod.balrog.prod.cloudops.mozgcp.net | udp |
| US | 8.8.8.8:53 | prod.balrog.prod.cloudops.mozgcp.net | udp |
| US | 8.8.8.8:53 | gateway.discord.gg | udp |
| US | 162.159.134.234:443 | gateway.discord.gg | tcp |
| US | 8.8.8.8:53 | 234.134.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | location.services.mozilla.com | udp |
| US | 35.190.72.216:443 | location.services.mozilla.com | tcp |
| US | 8.8.8.8:53 | prod.classify-client.prod.webservices.mozgcp.net | udp |
| US | 8.8.8.8:53 | prod.classify-client.prod.webservices.mozgcp.net | udp |
| US | 35.190.72.216:443 | prod.classify-client.prod.webservices.mozgcp.net | udp |
| US | 8.8.8.8:53 | 216.72.190.35.in-addr.arpa | udp |
| US | 162.159.134.234:443 | gateway.discord.gg | tcp |
Files
memory/4448-0-0x0000000073FBE000-0x0000000073FBF000-memory.dmp
memory/4448-1-0x0000000000AD0000-0x0000000000AD8000-memory.dmp
memory/4448-2-0x0000000005800000-0x0000000005CFE000-memory.dmp
memory/4448-3-0x00000000053A0000-0x0000000005432000-memory.dmp
memory/4448-4-0x0000000005340000-0x000000000534A000-memory.dmp
memory/4448-5-0x0000000073FB0000-0x000000007469E000-memory.dmp
memory/4448-6-0x0000000073FBE000-0x0000000073FBF000-memory.dmp
memory/4448-7-0x0000000073FB0000-0x000000007469E000-memory.dmp
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\04601f6f-0a35-4605-95b7-0cb627c49444
| MD5 | ec53fc27039818a9bc9a3013087b7d24 |
| SHA1 | deae697084db806b141e4de4037cd4d225903954 |
| SHA256 | 1a74e903edd9a4d18533e1e3e74f7c0baa10eb108680b7f9baf92f8d7511075a |
| SHA512 | b496f26876b8ba70aa2753e7453dfeb1fbc08ad98f37346b16dd49c28e3cc87ce7b87bac05199b605d590029529880ab066b6d77a161031a7527f77b82c0ca08 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\44deede7-38fe-4502-9453-4a5e59627163
| MD5 | 1634bdcaf817f04bce1c5810752c0e72 |
| SHA1 | aea88da2600a9fae31e75593d213a685d74d4695 |
| SHA256 | 0d5c1aec01d580916b4d271abd3b46b61413aa6554648f78d1c82c69ee286bec |
| SHA512 | f034889238bc6ef0514f3d592a4f8915ab095d8fe5daf9cf6c6f440e9970e0e756821b8ac252018e85e3eb9cfd239b977d4c79f79b06d217a748de3838c0b649 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\db\data.safe.bin
| MD5 | 405584b73df4adf0d82c07e660e3d770 |
| SHA1 | 6e23d4bf99c47da1a67a53cb6a19602943cac7a3 |
| SHA256 | 1dfa8c141ccc6a321b7dff20b9fade4ba43dcf5bdf2026fe70b763dc4160f47c |
| SHA512 | c6e4497429220b0bc67f9558f3986c5c3db3f542866723fc780390d417a713d85eb920faba508301dc3139e72e818cbaae2d6b65d371c2710edd03650ebfecc3 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
| MD5 | e7d901ad03d22078f4c42ecc83c3bd45 |
| SHA1 | 13ffe2ced2026e6b99c39a96d006c7832a72ba17 |
| SHA256 | fddee54013f830a84e74dce5679f6e4c3c71b4c5c51ecdf58bcef7e27eba4f17 |
| SHA512 | 8e7373116183db845f03c74e28effbe85b53c6c109f0a1a867fc4daa2944c099846644c5b6ecfa6408091d097a08b3f1b8cedcbeffbdcfaa14147f6b76663ec9 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js
| MD5 | da2b14c738cad9078c4b378a7b86a62d |
| SHA1 | dbc0cab3bc16cdd9ac80547b806851badb38a8b5 |
| SHA256 | 8a619affc70dd57a7cc0521b9b81a43ba91f3740274beb50b498bfb3f9998f45 |
| SHA512 | f41528ebc8db8b132fc95fc40d53ed70d2e157cda6fed834e01ada6ce04fe2da608cddd69d1efb091c9eee4278ceee6b950a1f7915788927625803e95a993867 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\sessionstore-backups\recovery.jsonlz4
| MD5 | f5d9025878b6f11014cb18c4cd08cfb2 |
| SHA1 | 48b71fbd0490c9f4dac0c29f4714bcc6cd5e2550 |
| SHA256 | 3c039770c22525ffd79dee0a4c719755037f963df4ac33cfa54b4fb6817ab417 |
| SHA512 | 672eb073a65a733513b9d8fa3d5344ded2e653b3acad610cff4604f7d690a152e1d765fb850bce5c60cf372e7d333e7247ffce3100a0d410fda45e5c76ae66fe |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js
| MD5 | 58a656db65d99a973273997ebed50433 |
| SHA1 | c6ca1b9d4f09b4a64e21d7aeafd5e09e3fcb14cc |
| SHA256 | d3ef13a119bd5bf37c109d0b61a8a977913c8e60801384339c625af6fbb04a9a |
| SHA512 | 45d81319cad83f9daa0f90ace0ebe3beeeba97f66c143d557744dd1ee7405d9e1a7a52b31f341f9857fc07dc8db1d267e2bc5a3894b42ce7e66940bdd4309bc3 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\5b000388-3f2b-4488-8f5b-1f0a8d0c1f2f
| MD5 | 5e6eaee3376f9bab4b1382e5efecac62 |
| SHA1 | 246de85dcb901c6b4ef0226ee2dbb79bf9eee1cb |
| SHA256 | b938183ecf15c8d519c443ddd867541638f3e989b5cf852bc9a065ed47b936a0 |
| SHA512 | 70dfb01e5ea81b6fee6597edb97f27d602e4611818f565ed60da30f4378d3b2c9d895b5e5f10c507260d21a5c1f15d5f1dceea668518b49b88deda9d3184e39e |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\datareporting\glean\pending_pings\7dbb8de9-21f3-4b51-95e3-cb63266e3aa2
| MD5 | 852fa103888b26a5f36957012e5e834d |
| SHA1 | 181a48f95c87c45e764c8bc4cc00e8e51d0b5276 |
| SHA256 | 91be78ae2676dc4f94f59c5a2bd07c9e2fb5c3fd6b66afc59ade2a0f043f4bb7 |
| SHA512 | 40bad23f51594410be7900dd8bd8d8cbbc8b08df9fc7e9352ca23f89a0b550800e1ae2305437985a12c76b1b1f6c4bf8198f40380b668506ff0e30ad0864a7c7 |
memory/4448-157-0x0000000008640000-0x0000000008762000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms
| MD5 | b1891a1f567af07b802356944ab50a00 |
| SHA1 | 50738e56904eaef601935208e736d78c7e038749 |
| SHA256 | 6f14986c2d5154ced1a2e11acdc8c199602a8b77741bbfdf58f7b5c64cd19092 |
| SHA512 | 1020cb57aa66b40225dc1e31e793f2f7afe8ca42c30861566107125057ba88820f1323e07620e70033e74f2e3eea1a979f89835501485e04c0c269b86215f8dc |
C:\Users\Admin\AppData\Local\Temp\Client-built.exe
| MD5 | 6f5f5e19ad0a4edcc27d9c1e62eb277d |
| SHA1 | 1ec7862fbe280a795f16b646be95ab51b62c61a8 |
| SHA256 | 5167c4f7656f9b89402f12a80d6dbbb2a202c0dcce5b9233c39b75392d66a864 |
| SHA512 | 1a0fbf96a9fbcbbd017b46841c6e7cb857ddce5cb230d4100e3e5a42be3a79e21c63d5fbd7de812cada1991695049b92feded6dcf551b41b9f9ce96ab858f007 |
memory/3488-186-0x00007FFA8C263000-0x00007FFA8C264000-memory.dmp
memory/3488-187-0x000002128E040000-0x000002128E058000-memory.dmp
memory/3488-188-0x00000212A86F0000-0x00000212A88B2000-memory.dmp
memory/3488-189-0x00007FFA8C260000-0x00007FFA8CC4C000-memory.dmp
memory/3488-190-0x00000212A8EF0000-0x00000212A9416000-memory.dmp
memory/3488-191-0x00007FFA8C263000-0x00007FFA8C264000-memory.dmp
memory/3488-192-0x00007FFA8C260000-0x00007FFA8CC4C000-memory.dmp
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs-1.js
| MD5 | ef29a265c20e9fd035292a106cdac714 |
| SHA1 | 436ed1fd268e0a01029b6d64c1ab3b8841d539e8 |
| SHA256 | 887437e96ab2f35b7c1a1403ef09ec272d6b10d8dd0820a4f8a10154428d4f61 |
| SHA512 | 2f6001957d9772aa585297f4b4e2143d0a049e9f8a4d9816d2228fe0124241a7f44c483b2e11d63e1b5bb044b734ca9160f0d46afaf8a946e8dba826132a956c |
C:\Users\Admin\AppData\Local\Temp\tmpaddon
| MD5 | 85430baed3398695717b0263807cf97c |
| SHA1 | fffbee923cea216f50fce5d54219a188a5100f41 |
| SHA256 | a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e |
| SHA512 | 06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
| MD5 | fe3355639648c417e8307c6d051e3e37 |
| SHA1 | f54602d4b4778da21bc97c7238fc66aa68c8ee34 |
| SHA256 | 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e |
| SHA512 | 8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
| MD5 | 3d33cdc0b3d281e67dd52e14435dd04f |
| SHA1 | 4db88689282fd4f9e9e6ab95fcbb23df6e6485db |
| SHA256 | f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b |
| SHA512 | a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1 |
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F
| MD5 | 4a88480009247948764498f72415443b |
| SHA1 | 0f541c5d53b157af8071417a9eea9ec4f95951ac |
| SHA256 | f9b1059771e9a5a77cf705b1234e9a38a180883c366407a882b44be501bf3041 |
| SHA512 | c2bf4af438d8100049b6001b2732a32f053066dda968dadee8ba5189d1725314f66771bf8b5b1aff3e5adae75ca467f13b12f8bddc5be68a7304bf92e69673fd |
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
| MD5 | a01c5ecd6108350ae23d2cddf0e77c17 |
| SHA1 | c6ac28a2cd979f1f9a75d56271821d5ff665e2b6 |
| SHA256 | 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42 |
| SHA512 | b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
| MD5 | 49ddb419d96dceb9069018535fb2e2fc |
| SHA1 | 62aa6fea895a8b68d468a015f6e6ab400d7a7ca6 |
| SHA256 | 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539 |
| SHA512 | 48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
| MD5 | 8be33af717bb1b67fbd61c3f4b807e9e |
| SHA1 | 7cf17656d174d951957ff36810e874a134dd49e0 |
| SHA256 | e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd |
| SHA512 | 6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
| MD5 | 937326fead5fd401f6cca9118bd9ade9 |
| SHA1 | 4526a57d4ae14ed29b37632c72aef3c408189d91 |
| SHA256 | 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81 |
| SHA512 | b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
| MD5 | 688bed3676d2104e7f17ae1cd2c59404 |
| SHA1 | 952b2cdf783ac72fcb98338723e9afd38d47ad8e |
| SHA256 | 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237 |
| SHA512 | 7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
| MD5 | 33bf7b0439480effb9fb212efce87b13 |
| SHA1 | cee50f2745edc6dc291887b6075ca64d716f495a |
| SHA256 | 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e |
| SHA512 | d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275 |
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
| MD5 | 627c699be174c94df58ef6e4d3fc4092 |
| SHA1 | e8fe9c88573789c865fdaa0fecf3e3ea6db8d534 |
| SHA256 | 2ae8ee232b2a98f3848bc7d0487161dc630f5398382079549b598173d276fdb6 |
| SHA512 | 6140f6a7da9668f2e59d05f3c9b10e9d1847f62c0f09e712c9cdc7cbe7fa082a9d8a88454bc97a541d533777c2f0e26d99cdece7e9071126757275aeb5399b4b |
memory/3488-2509-0x00007FFA8C260000-0x00007FFA8CC4C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Client-built.exe
| MD5 | 2c5322996bc9a338e5dc43054ae30f56 |
| SHA1 | 05bb43e254c41278c02a626a328839be408a7673 |
| SHA256 | 5b9173d02cf919121e75c8d512509125915b300c6f44f459c45d44479394253f |
| SHA512 | 2476446083b82716e603a4487e03f6641aeb3f2d86ba16eb19909782204cf38ab3ea8a1446cf5361a3082624a2cc352c67b2d555366ac67e6d53433b405ecf1f |
memory/4152-2530-0x000002C832710000-0x000002C832728000-memory.dmp
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\SiteSecurityServiceState.txt
| MD5 | cd04c43b4ea02f440f16dba29ddb20d3 |
| SHA1 | e9c778b52a7e96a2c1db8ea4a298538207825e80 |
| SHA256 | 4eb17a2d7d73df58f6051b3736df3a55155877c5c3d22c25c24c89bfc0b19477 |
| SHA512 | 21d45e6880db68fffd6d8e5c52410fedd2f6f5ce5f9f4baf2199bf4b84c007cf533b7ed42b7a2283175edf9b25f36a5c6df478fb7d85d4a095cb169f3d164dff |
Analysis: behavioral3
Detonation Overview
Submitted
2024-09-12 14:44
Reported
2024-09-12 14:46
Platform
win10-20240404-en
Max time kernel
134s
Max time network
135s
Command Line
Signatures
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\dnlib.dll,#1
Network
| Country | Destination | Domain | Proto |
| US | 52.111.227.14:443 | tcp | |
| US | 8.8.8.8:53 | 22.236.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 63.141.182.52.in-addr.arpa | udp |
Files
Analysis: behavioral1
Detonation Overview
Submitted
2024-09-12 14:44
Reported
2024-09-12 14:50
Platform
win10-20240611-en
Max time kernel
315s
Max time network
322s
Command Line
Signatures
Discord RAT
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Release\Discord rat.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Release\Discord rat.exe
"C:\Users\Admin\AppData\Local\Temp\Release\Discord rat.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | gateway.discord.gg | udp |
| US | 162.159.134.234:443 | gateway.discord.gg | tcp |
| US | 8.8.8.8:53 | 234.134.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 77.239.69.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.144.22.2.in-addr.arpa | udp |
Files
memory/1588-0-0x00007FFDA9383000-0x00007FFDA9384000-memory.dmp
memory/1588-1-0x0000028C61120000-0x0000028C61138000-memory.dmp
memory/1588-2-0x0000028C7B7C0000-0x0000028C7B982000-memory.dmp
memory/1588-3-0x00007FFDA9380000-0x00007FFDA9D6C000-memory.dmp
memory/1588-4-0x0000028C7BEC0000-0x0000028C7C3E6000-memory.dmp
memory/1588-5-0x00007FFDA9380000-0x00007FFDA9D6C000-memory.dmp