Analysis
-
max time kernel
28s -
max time network
21s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
29-09-2024 21:12
Behavioral task
behavioral1
Sample
0.exe
Resource
win10-20240404-en
windows10-1703-x64
8 signatures
150 seconds
General
-
Target
0.exe
-
Size
78KB
-
MD5
1b9c81334aa2661c3be9bf1a12db2aae
-
SHA1
7ac337e1eb0adac85cf54a605183b25ba0a12fd4
-
SHA256
b020c31ce78bdf2200b9dadc61fd7ad0e34e3f9c05cf3724743ca9e58c7bec44
-
SHA512
73761d06a1945b608eb0c03f3da01149177b342cb2ecb50f9c2aedfce8d34bd1efc309fe13cb5d0ad128247ea9c060ce747f753dbfe2af31a16c729587aebdf9
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+ZDPIC:5Zv5PDwbjNrmAE+ZbIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI4OTU5MTU3OTc0NDY2NTYwMQ.GeVN_G.B9uH1vpClVyq73820fXzo5z7HFsuew0uArUTHU
-
server_id
1289604307905413142
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 8 discord.com 9 discord.com 13 discord.com -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4836 0.exe Token: SeDebugPrivilege 752 taskmgr.exe Token: SeSystemProfilePrivilege 752 taskmgr.exe Token: SeCreateGlobalPrivilege 752 taskmgr.exe -
Suspicious use of FindShellTrayWindow 31 IoCs
pid Process 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe -
Suspicious use of SendNotifyMessage 31 IoCs
pid Process 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe 752 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0.exe"C:\Users\Admin\AppData\Local\Temp\0.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4836
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:752