Analysis
-
max time kernel
279s -
max time network
270s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20-09-2024 16:06
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
13 signatures
1800 seconds
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
6de48dc636e876d997534aa3c5a1b368
-
SHA1
02b08b739531593ac72dd2aa92b75e3466428b11
-
SHA256
bbaa30ea37df3080078f35ccd41e6e1c3fe66c81d7c80dda3cf5299af988122c
-
SHA512
23b1cdbfbc45b95e205f43e48028e5943a3a7c7c9960291e16ce34dafcb53e0e679523f30cb739bf8926355d3eb7d817d5b97c1fc722b192d9cac2925cb6380c
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+WwPIC:5Zv5PDwbjNrmAE+W0IC
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI4NjcwOTYwMTQwNzg2MDc3Nw.GdbB5d.SstzGRfJxvsS7oS6I1M3fQK9g8R5_he-FnX100
-
server_id
1286709234360385586
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Abuse Elevation Control Mechanism: Bypass User Account Control 1 TTPs 1 IoCs
UAC Bypass Attempt via SilentCleanup Task.
pid Process 3596 SCHTASKS.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs
flow ioc 51 discord.com 52 discord.com 53 discord.com 20 discord.com 28 discord.com 25 discord.com 60 discord.com 9 discord.com 10 discord.com -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3952 SCHTASKS.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2744 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2204 Client-built.exe Token: SeDebugPrivilege 2744 taskmgr.exe Token: SeSystemProfilePrivilege 2744 taskmgr.exe Token: SeCreateGlobalPrivilege 2744 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe 2744 taskmgr.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2204 wrote to memory of 3952 2204 Client-built.exe 91 PID 2204 wrote to memory of 3952 2204 Client-built.exe 91 PID 2204 wrote to memory of 3596 2204 Client-built.exe 95 PID 2204 wrote to memory of 3596 2204 Client-built.exe 95 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SYSTEM32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Client-built.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\Client-built.exe'" /sc onlogon /rl HIGHEST2⤵
- Scheduled Task/Job: Scheduled Task
PID:3952
-
-
C:\Windows\SYSTEM32\SCHTASKS.exe"SCHTASKS.exe" /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I2⤵
- Abuse Elevation Control Mechanism: Bypass User Account Control
PID:3596
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2744
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:980