Resubmissions
13-10-2024 21:01
241013-zt5yqssflj 1013-10-2024 06:17
241013-g15mfasglc 1013-10-2024 06:14
241013-gzc6ssxaqp 10Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
13-10-2024 06:14
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
d4adc993c113b97f4c878c71febce4d3
-
SHA1
9deb50c3b6ba75baa07e7e7e1500990ca677f8ac
-
SHA256
d311fd04604623924d61afe0ffa69eacfc6e25bf84d927f973513071c8c074cb
-
SHA512
f6c47b53a92da4c8a69ca1908009614741586c45410334aa0f99e1f1a131b5ffee0527ec7ea8218207f16e7cfeb2c558ed9c2101aae9e02c8d24bbfd0314b8f5
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+TPIC:5Zv5PDwbjNrmAE+LIC
Malware Config
Extracted
discordrat
-
discord_token
MTI4MjAzMjIzOTc0NzY2NTk0MA.GPc649.bqv1Qp-52Jaq9kMAZZNXa-CNlHUfD5c8_Q9GLY
-
server_id
1289619296036851775
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Disables Task Manager via registry modification
-
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs
-
Drops file in Windows directory 2 IoCs
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 30 IoCs
-
Suspicious use of SendNotifyMessage 29 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\NetSh.exe"NetSh.exe" Advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
9.9MB
-
Filesize
5.1MB
-
Filesize
4KB
-
Filesize
9.9MB
-
Filesize
56KB