Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20-09-2024 12:09
Behavioral task
behavioral1
Sample
AllizSpoofer.exe
Resource
win7-20240708-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
AllizSpoofer.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
AllizSpoofer.exe
-
Size
78KB
-
MD5
fce4de2c4e5a0138fc162ce7e73ffdc2
-
SHA1
732fcd5f024aa5752b2ef3d8f6ddf0f40e93c714
-
SHA256
43409f8adcbaae22211ffac1ae7075fd02b8e31e6a045fc5ef33c61e8f80d5f3
-
SHA512
22be75bed543e2541f37890541eb0e8a2ad526c1c5f1dd7c930a13857f23804dbdf4339772a17d5d40e4b8c24f9b6c5df2ecc3587f8f65b58dc8eff4d09ea406
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+2PIC:5Zv5PDwbjNrmAE+yIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI4NjYzMjk0Njg1NzY3MjcwNA.GRnd3c.uBOFgmowGMuT8g9W0s-CmrMTXr5VDVgIZ5biXM
-
server_id
1286626810435731498
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Downloads MZ/PE file
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs
flow ioc 8 discord.com 31 discord.com 32 discord.com 36 discord.com 9 discord.com 38 discord.com 53 discord.com 54 discord.com 23 discord.com 33 raw.githubusercontent.com 34 raw.githubusercontent.com 35 discord.com 39 discord.com -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2200 AllizSpoofer.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2508 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2200 AllizSpoofer.exe Token: SeDebugPrivilege 2508 taskmgr.exe Token: SeSystemProfilePrivilege 2508 taskmgr.exe Token: SeCreateGlobalPrivilege 2508 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe 2508 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AllizSpoofer.exe"C:\Users\Admin\AppData\Local\Temp\AllizSpoofer.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2200
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2508