Analysis

  • max time kernel
    87s
  • max time network
    116s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    25-09-2024 04:53

General

  • Target

    Client-built.exe

  • Size

    78KB

  • MD5

    c91180675d8818997b47da2ccf7abe11

  • SHA1

    68be71d55c1e74ec342400555c2aa46e4adaf11b

  • SHA256

    c328dc708e13a083becaf40b328c3206a7eae31c59ae3b11f163365f44847084

  • SHA512

    bd345a8dac0898cc548ccde1ee8ad83fd63de69abb21f04718eec334142d81414a81ce2b7cdd28fa894d9c9183931fff5693d7dd5bcf3754b08dccac5986cdb2

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+OPIC:5Zv5PDwbjNrmAE+qIC

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTI0OTEyMzM0OTI4MDQ1NjcxNw.GnYIbe.bvGZ_OyLyK5l9y4XcX45-oxZN0FsX_chY7cS44

  • server_id

    1278933265062957099

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Downloads MZ/PE file
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 19 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:584
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:1004
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{92c2249a-dcab-4c55-8eed-e908f9aad71c}
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3312
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
          PID:636
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
          1⤵
            PID:720
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
            1⤵
              PID:904
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
              1⤵
                PID:360
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                1⤵
                  PID:604
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
                  1⤵
                    PID:392
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
                    1⤵
                      PID:1080
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                      1⤵
                        PID:1120
                        • c:\windows\system32\taskhostw.exe
                          taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                          2⤵
                            PID:3036
                        • c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k localservice -s nsi
                          1⤵
                            PID:1196
                          • c:\windows\system32\svchost.exe
                            c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                            1⤵
                              PID:1212
                            • c:\windows\system32\svchost.exe
                              c:\windows\system32\svchost.exe -k netsvcs -s Themes
                              1⤵
                                PID:1232
                              • c:\windows\system32\svchost.exe
                                c:\windows\system32\svchost.exe -k localservice -s EventSystem
                                1⤵
                                  PID:1260
                                • c:\windows\system32\svchost.exe
                                  c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
                                  1⤵
                                    PID:1384
                                  • c:\windows\system32\svchost.exe
                                    c:\windows\system32\svchost.exe -k netsvcs -s SENS
                                    1⤵
                                      PID:1444
                                    • c:\windows\system32\svchost.exe
                                      c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                                      1⤵
                                        PID:1464
                                        • c:\windows\system32\sihost.exe
                                          sihost.exe
                                          2⤵
                                            PID:2916
                                        • c:\windows\system32\svchost.exe
                                          c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
                                          1⤵
                                            PID:1508
                                          • c:\windows\system32\svchost.exe
                                            c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
                                            1⤵
                                              PID:1532
                                            • c:\windows\system32\svchost.exe
                                              c:\windows\system32\svchost.exe -k networkservice -s Dnscache
                                              1⤵
                                                PID:1572
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                                                1⤵
                                                  PID:1648
                                                • c:\windows\system32\svchost.exe
                                                  c:\windows\system32\svchost.exe -k localservice -s netprofm
                                                  1⤵
                                                    PID:1728
                                                  • C:\Windows\System32\svchost.exe
                                                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                                                    1⤵
                                                      PID:1756
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
                                                      1⤵
                                                        PID:1772
                                                      • c:\windows\system32\svchost.exe
                                                        c:\windows\system32\svchost.exe -k appmodel -s StateRepository
                                                        1⤵
                                                          PID:1860
                                                        • c:\windows\system32\svchost.exe
                                                          c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                                                          1⤵
                                                            PID:1872
                                                          • C:\Windows\System32\spoolsv.exe
                                                            C:\Windows\System32\spoolsv.exe
                                                            1⤵
                                                              PID:2020
                                                            • c:\windows\system32\svchost.exe
                                                              c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
                                                              1⤵
                                                                PID:1676
                                                              • c:\windows\system32\svchost.exe
                                                                c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
                                                                1⤵
                                                                  PID:2316
                                                                • c:\windows\system32\svchost.exe
                                                                  c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
                                                                  1⤵
                                                                    PID:2340
                                                                  • c:\windows\system32\svchost.exe
                                                                    c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                                                                    1⤵
                                                                      PID:2348
                                                                    • c:\windows\system32\svchost.exe
                                                                      c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
                                                                      1⤵
                                                                        PID:2388
                                                                      • c:\windows\system32\svchost.exe
                                                                        c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
                                                                        1⤵
                                                                          PID:2404
                                                                        • C:\Windows\sysmon.exe
                                                                          C:\Windows\sysmon.exe
                                                                          1⤵
                                                                            PID:2444
                                                                          • c:\windows\system32\svchost.exe
                                                                            c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
                                                                            1⤵
                                                                              PID:2452
                                                                            • c:\windows\system32\svchost.exe
                                                                              c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
                                                                              1⤵
                                                                                PID:2464
                                                                              • c:\windows\system32\svchost.exe
                                                                                c:\windows\system32\svchost.exe -k netsvcs -s WpnService
                                                                                1⤵
                                                                                  PID:2488
                                                                                • c:\windows\system32\svchost.exe
                                                                                  c:\windows\system32\svchost.exe -k netsvcs -s Browser
                                                                                  1⤵
                                                                                    PID:2892
                                                                                  • c:\windows\system32\svchost.exe
                                                                                    c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
                                                                                    1⤵
                                                                                      PID:2936
                                                                                    • c:\windows\system32\svchost.exe
                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s TokenBroker
                                                                                      1⤵
                                                                                        PID:2676
                                                                                      • C:\Windows\system32\wbem\unsecapp.exe
                                                                                        C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                                        1⤵
                                                                                          PID:3144
                                                                                        • C:\Windows\Explorer.EXE
                                                                                          C:\Windows\Explorer.EXE
                                                                                          1⤵
                                                                                            PID:3316
                                                                                            • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
                                                                                              2⤵
                                                                                              • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                              • Suspicious use of SetThreadContext
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4584
                                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                            1⤵
                                                                                              PID:3824
                                                                                            • C:\Windows\system32\DllHost.exe
                                                                                              C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                              1⤵
                                                                                                PID:3648
                                                                                              • c:\windows\system32\svchost.exe
                                                                                                c:\windows\system32\svchost.exe -k localservice -s CDPSvc
                                                                                                1⤵
                                                                                                  PID:4868
                                                                                                • c:\windows\system32\svchost.exe
                                                                                                  c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
                                                                                                  1⤵
                                                                                                    PID:4692
                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                    C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
                                                                                                    1⤵
                                                                                                    • Modifies data under HKEY_USERS
                                                                                                    PID:508
                                                                                                  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                    1⤵
                                                                                                    • Drops file in System32 directory
                                                                                                    • Modifies data under HKEY_USERS
                                                                                                    PID:4304
                                                                                                  • c:\windows\system32\svchost.exe
                                                                                                    c:\windows\system32\svchost.exe -k netsvcs -s wlidsvc
                                                                                                    1⤵
                                                                                                      PID:4468
                                                                                                    • C:\Windows\system32\DllHost.exe
                                                                                                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                      1⤵
                                                                                                        PID:3788
                                                                                                      • C:\Windows\system32\ApplicationFrameHost.exe
                                                                                                        C:\Windows\system32\ApplicationFrameHost.exe -Embedding
                                                                                                        1⤵
                                                                                                          PID:2900
                                                                                                        • C:\Windows\System32\InstallAgent.exe
                                                                                                          C:\Windows\System32\InstallAgent.exe -Embedding
                                                                                                          1⤵
                                                                                                            PID:1168
                                                                                                          • C:\Windows\system32\DllHost.exe
                                                                                                            C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
                                                                                                            1⤵
                                                                                                              PID:4824

                                                                                                            Network

                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                            Replay Monitor

                                                                                                            Loading Replay Monitor...

                                                                                                            Downloads

                                                                                                            • memory/584-21-0x0000023190320000-0x0000023190343000-memory.dmp

                                                                                                              Filesize

                                                                                                              140KB

                                                                                                            • memory/584-28-0x0000023190350000-0x000002319037A000-memory.dmp

                                                                                                              Filesize

                                                                                                              168KB

                                                                                                            • memory/584-29-0x00007FFB39210000-0x00007FFB39220000-memory.dmp

                                                                                                              Filesize

                                                                                                              64KB

                                                                                                            • memory/584-31-0x0000023190350000-0x000002319037A000-memory.dmp

                                                                                                              Filesize

                                                                                                              168KB

                                                                                                            • memory/636-23-0x000002DB10C30000-0x000002DB10C5A000-memory.dmp

                                                                                                              Filesize

                                                                                                              168KB

                                                                                                            • memory/636-24-0x00007FFB39210000-0x00007FFB39220000-memory.dmp

                                                                                                              Filesize

                                                                                                              64KB

                                                                                                            • memory/636-26-0x000002DB10C30000-0x000002DB10C5A000-memory.dmp

                                                                                                              Filesize

                                                                                                              168KB

                                                                                                            • memory/636-27-0x00007FFB79225000-0x00007FFB79226000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                            • memory/1004-114-0x0000026070180000-0x00000260701AA000-memory.dmp

                                                                                                              Filesize

                                                                                                              168KB

                                                                                                            • memory/1004-35-0x0000026070180000-0x00000260701AA000-memory.dmp

                                                                                                              Filesize

                                                                                                              168KB

                                                                                                            • memory/1004-36-0x00007FFB39210000-0x00007FFB39220000-memory.dmp

                                                                                                              Filesize

                                                                                                              64KB

                                                                                                            • memory/3312-10-0x0000000140000000-0x0000000140040000-memory.dmp

                                                                                                              Filesize

                                                                                                              256KB

                                                                                                            • memory/3312-15-0x00007FFB77EC0000-0x00007FFB77F6E000-memory.dmp

                                                                                                              Filesize

                                                                                                              696KB

                                                                                                            • memory/3312-18-0x00007FFB79180000-0x00007FFB7935B000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.9MB

                                                                                                            • memory/3312-17-0x00007FFB79181000-0x00007FFB7928F000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.1MB

                                                                                                            • memory/3312-247-0x00007FFB79180000-0x00007FFB7935B000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.9MB

                                                                                                            • memory/3312-14-0x00007FFB79180000-0x00007FFB7935B000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.9MB

                                                                                                            • memory/3312-12-0x0000000140000000-0x0000000140040000-memory.dmp

                                                                                                              Filesize

                                                                                                              256KB

                                                                                                            • memory/3312-19-0x0000000140000000-0x0000000140040000-memory.dmp

                                                                                                              Filesize

                                                                                                              256KB

                                                                                                            • memory/3312-13-0x0000000140000000-0x0000000140040000-memory.dmp

                                                                                                              Filesize

                                                                                                              256KB

                                                                                                            • memory/3316-77-0x0000000000950000-0x000000000097A000-memory.dmp

                                                                                                              Filesize

                                                                                                              168KB

                                                                                                            • memory/3316-78-0x00007FFB39210000-0x00007FFB39220000-memory.dmp

                                                                                                              Filesize

                                                                                                              64KB

                                                                                                            • memory/4584-9-0x00007FFB77EC0000-0x00007FFB77F6E000-memory.dmp

                                                                                                              Filesize

                                                                                                              696KB

                                                                                                            • memory/4584-3-0x00007FFB5D420000-0x00007FFB5DE0C000-memory.dmp

                                                                                                              Filesize

                                                                                                              9.9MB

                                                                                                            • memory/4584-8-0x00007FFB79180000-0x00007FFB7935B000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.9MB

                                                                                                            • memory/4584-7-0x00000292F8DD0000-0x00000292F8E0E000-memory.dmp

                                                                                                              Filesize

                                                                                                              248KB

                                                                                                            • memory/4584-6-0x00007FFB5D420000-0x00007FFB5DE0C000-memory.dmp

                                                                                                              Filesize

                                                                                                              9.9MB

                                                                                                            • memory/4584-5-0x00007FFB5D423000-0x00007FFB5D424000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                            • memory/4584-4-0x00000292F9160000-0x00000292F9686000-memory.dmp

                                                                                                              Filesize

                                                                                                              5.1MB

                                                                                                            • memory/4584-0-0x00007FFB5D423000-0x00007FFB5D424000-memory.dmp

                                                                                                              Filesize

                                                                                                              4KB

                                                                                                            • memory/4584-2-0x00000292F8960000-0x00000292F8B22000-memory.dmp

                                                                                                              Filesize

                                                                                                              1.8MB

                                                                                                            • memory/4584-11-0x00007FFB5D420000-0x00007FFB5DE0C000-memory.dmp

                                                                                                              Filesize

                                                                                                              9.9MB

                                                                                                            • memory/4584-1-0x00000292F63D0000-0x00000292F63E8000-memory.dmp

                                                                                                              Filesize

                                                                                                              96KB

                                                                                                            • memory/4584-245-0x00007FFB5D420000-0x00007FFB5DE0C000-memory.dmp

                                                                                                              Filesize

                                                                                                              9.9MB

                                                                                                            • memory/4584-246-0x00007FFB5D420000-0x00007FFB5DE0C000-memory.dmp

                                                                                                              Filesize

                                                                                                              9.9MB

                                                                                                            • memory/4584-16-0x00007FFB5D420000-0x00007FFB5DE0C000-memory.dmp

                                                                                                              Filesize

                                                                                                              9.9MB

                                                                                                            • memory/4584-250-0x00000292F8950000-0x00000292F895E000-memory.dmp

                                                                                                              Filesize

                                                                                                              56KB