Analysis
-
max time kernel
1799s -
max time network
1776s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
19-10-2024 03:30
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win11-20241007-en
windows11-21h2-x64
11 signatures
1800 seconds
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
8500fa817aaf7bd8f5dcfbdd4349113c
-
SHA1
adf69021bccf0b921054733e150a50d6ceddcf38
-
SHA256
3646da9cc1bc925b19c4201d42dffe7b081b6ef669df4640afe6906b75255e97
-
SHA512
d06dcee6600cbaf568816f63dc33d05e35309a5ef5a2bb3628191db7a86890720aeda79e3b50bb2a7fc0ce050730a0d154d9fe849ec98303e4d483f3edd11d44
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+oPIC:5Zv5PDwbjNrmAE+sIC
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI5NzAyNTkxODU0Nzc5MTk1Mw.GCZwQh.vmOtb2lv8_CvB7LE33XNynsJYJxp3cni1mBINY
-
server_id
1297025877313585163
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Disables Task Manager via registry modification
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs
Processes:
flow ioc 6 discord.com 7 discord.com 8 discord.com 10 raw.githubusercontent.com 12 discord.com 13 discord.com 14 discord.com 3 discord.com 4 discord.com 11 discord.com 3 raw.githubusercontent.com -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
Processes:
taskmgr.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-2499603254-3415597248-1508446358-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exepid Process 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid Process 2940 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Client-built.exetaskmgr.exedescription pid Process Token: SeDebugPrivilege 3068 Client-built.exe Token: SeDebugPrivilege 2940 taskmgr.exe Token: SeSystemProfilePrivilege 2940 taskmgr.exe Token: SeCreateGlobalPrivilege 2940 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid Process 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid Process 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe 2940 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3068
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2364
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵PID:3524
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2940