Analysis
-
max time kernel
133s -
max time network
137s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
29-09-2024 20:48
Behavioral task
behavioral1
Sample
1.exe
Resource
win10-20240404-en
windows10-1703-x64
7 signatures
150 seconds
General
-
Target
1.exe
-
Size
78KB
-
MD5
5e0f152f905d6b766dac11b352f921d8
-
SHA1
5f094138195b7ac741db186448e29eae4da48853
-
SHA256
4a2d4fa7402df75d29c69d179a2d1772cd94fe460bf93d4e55fef5f4f4d665da
-
SHA512
1c48a44ca6ce92c02e240c5d2e66722c2da9fa08f2d8132b3a8e96e538ed14db747a17d59a3f30a4bc53845dacb274961c752a57c1609d196cd05f859633bdef
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+QPIC:5Zv5PDwbjNrmAE+UIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI4OTU5MTU3OTc0NDY2NTYwMQ.G59gK6.pTTAFMCAOLdVTFHpDhN9HLghhBJ8ROJ9r3Sw6Q
-
server_id
1289604307905413142
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 508 1.exe Token: SeDebugPrivilege 1048 taskmgr.exe Token: SeSystemProfilePrivilege 1048 taskmgr.exe Token: SeCreateGlobalPrivilege 1048 taskmgr.exe Token: 33 1048 taskmgr.exe Token: SeIncBasePriorityPrivilege 1048 taskmgr.exe -
Suspicious use of FindShellTrayWindow 45 IoCs
pid Process 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe -
Suspicious use of SendNotifyMessage 45 IoCs
pid Process 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe 1048 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1.exe"C:\Users\Admin\AppData\Local\Temp\1.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:508
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1048