Analysis
-
max time kernel
149s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-10-2024 20:57
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Client-built.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
0c293cd0aa86b06c1a976efea41644b1
-
SHA1
40ff39715953c258eab92d31525a69e124fe63fa
-
SHA256
5f16a9c7859b1a7e1ff26f076dff7197dd837ce8a7f1d52e075459a01c48381d
-
SHA512
60f784b9efebe7667b4ac842a71cac8a4d1badcd21c3c9ab3a60355c2425aac6989467c48349b96dde22ab05957f0917498bde29e70a6446e610dbb80bb13964
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+vPIC:5Zv5PDwbjNrmAE+XIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTI5OTQ3NjM2MDE0MTczODEwNA.G8hMss.Newf7HvqfYebdbU57NfSxLCiQR2WOoaKAi70TA
-
server_id
1299474539683647519
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
Processes:
taskmgr.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exepid Process 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid Process 4036 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Client-built.exetaskmgr.exedescription pid Process Token: SeDebugPrivilege 3664 Client-built.exe Token: SeDebugPrivilege 4036 taskmgr.exe Token: SeSystemProfilePrivilege 4036 taskmgr.exe Token: SeCreateGlobalPrivilege 4036 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid Process 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid Process 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe 4036 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3664
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4036
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2380