Analysis
-
max time kernel
54s -
max time network
49s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14-09-2024 05:40
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
359b751183be791b8100184be2351d25
-
SHA1
8285d52626a0a00cdb151e5d5cf886b5aabbac4f
-
SHA256
bc40be55d7b2175ad80815a48393a70194f098dd21ad4a58698def7263bef1e9
-
SHA512
39506524d9b655f463839f7f1f2df28bfe6682b7ae4a2b02193484034253da9b3b5a41da244e4227ea7cc78e0cc26f20495a4cd54d82ec77f370722ec54c18e2
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+vPIC:5Zv5PDwbjNrmAE+XIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI4NDM4Mjk4NjYwNjg3NDcxNQ.GBnQgE.biTUCOhcaVlARgGjw53Ro9xzBlPffuvWyh7lBc
-
server_id
1284378215447658516
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation Client-built.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs
flow ioc 50 discord.com 9 discord.com 10 discord.com 23 discord.com 32 discord.com 35 discord.com 36 discord.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "182" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2536 SCHTASKS.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe -
Suspicious behavior: LoadsDriver 64 IoCs
pid Process 3604 Process not Found 3152 Process not Found 3892 Process not Found 116 Process not Found 2252 Process not Found 1012 Process not Found 4724 Process not Found 5040 Process not Found 2548 Process not Found 4888 Process not Found 220 Process not Found 1756 Process not Found 3660 Process not Found 4864 Process not Found 4452 Process not Found 1080 Process not Found 4484 Process not Found 3796 Process not Found 764 Process not Found 3192 Process not Found 3992 Process not Found 2412 Process not Found 2396 Process not Found 2504 Process not Found 2588 Process not Found 4368 Process not Found 5036 Process not Found 1732 Process not Found 2472 Process not Found 632 Process not Found 3612 Process not Found 4440 Process not Found 2420 Process not Found 1168 Process not Found 2092 Process not Found 2236 Process not Found 1228 Process not Found 2400 Process not Found 4564 Process not Found 3116 Process not Found 3996 Process not Found 4456 Process not Found 4636 Process not Found 4004 Process not Found 1720 Process not Found 1376 Process not Found 4880 Process not Found 2044 Process not Found 3196 Process not Found 4408 Process not Found 1588 Process not Found 412 Process not Found 1548 Process not Found 1516 Process not Found 1020 Process not Found 5020 Process not Found 4808 Process not Found 3056 Process not Found 1328 Process not Found 1952 Process not Found 1932 Process not Found 1740 Process not Found 2856 Process not Found 4020 Process not Found -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3480 Client-built.exe Token: SeDebugPrivilege 1812 taskmgr.exe Token: SeSystemProfilePrivilege 1812 taskmgr.exe Token: SeCreateGlobalPrivilege 1812 taskmgr.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe -
Suspicious use of SendNotifyMessage 34 IoCs
pid Process 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe 1812 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4448 LogonUI.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3480 wrote to memory of 2536 3480 Client-built.exe 95 PID 3480 wrote to memory of 2536 3480 Client-built.exe 95 PID 3480 wrote to memory of 2988 3480 Client-built.exe 100 PID 3480 wrote to memory of 2988 3480 Client-built.exe 100 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\SYSTEM32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Client-built.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\Client-built.exe'" /sc onlogon /rl HIGHEST2⤵
- Scheduled Task/Job: Scheduled Task
PID:2536
-
-
C:\Windows\System32\shutdown.exe"C:\Windows\System32\shutdown.exe" /L2⤵PID:2988
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1812
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa397b855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4448