Analysis
-
max time kernel
33s -
max time network
35s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-fr -
resource tags
arch:x64arch:x86image:win10v2004-20240802-frlocale:fr-fros:windows10-2004-x64systemwindows -
submitted
28-09-2024 14:59
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win10v2004-20240802-fr
windows10-2004-x64
8 signatures
1800 seconds
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
f9ccc3b920b155b87257c47d0657ccbf
-
SHA1
120fee2be7f31d93bbe8addbfe43542ab594e4db
-
SHA256
52806733876487d323b3bf9e9db60fc7600f75e4fa104ec6f7a469566b0613c6
-
SHA512
faf3241f0425024dd18f7a8a99d75d0a1b0d6411cac01546e6aebe993d1212a4fb294c513b92bda21bd8dc2cd157d6147083b87cba80e6bb408f2864f5264863
-
SSDEEP
1536:J2WjO8XeEXFR5P7v88wbjNrfxCXhRoKV6+V+6PIC:JZf5PDwbjNrmAE+mIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
2c063a195a76d80aa1582cb5cab8075c1628d5a3b7bb597316787d1a12b16175
-
server_id
1216215871526277180
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4728 Client-built.exe Token: SeDebugPrivilege 4668 taskmgr.exe Token: SeSystemProfilePrivilege 4668 taskmgr.exe Token: SeCreateGlobalPrivilege 4668 taskmgr.exe -
Suspicious use of FindShellTrayWindow 42 IoCs
pid Process 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe -
Suspicious use of SendNotifyMessage 42 IoCs
pid Process 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe 4668 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4728
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4668
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:376
-
C:\Windows\System32\-ue4vv.exe"C:\Windows\System32\-ue4vv.exe"1⤵PID:3100