Resubmissions
24/11/2024, 17:01
241124-vj2q4swkdl 1026/10/2024, 14:16
241026-rlatmawdjq 1026/10/2024, 14:13
241026-rjt5gsvele 10Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/10/2024, 14:13
Behavioral task
behavioral1
Sample
Release/Discord rat.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
300 seconds
Behavioral task
behavioral2
Sample
Release/Discord rat.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
300 seconds
General
-
Target
Release/Discord rat.exe
-
Size
79KB
-
MD5
d13905e018eb965ded2e28ba0ab257b5
-
SHA1
6d7fe69566fddc69b33d698591c9a2c70d834858
-
SHA256
2bd631c6665656673a923c13359b0dc211debc05b2885127e26b0dce808e2dec
-
SHA512
b95bfdebef33ac72b6c21cdf0abb4961222b7efd17267cd7236e731dd0b6105ece28e784a95455f1ffc8a6dd1d580a467b07b3bd8cb2fb19e2111f1a864c97cb
-
SSDEEP
1536:YCH0jBD2BKkwbPNrfxCXhRoKV6+V+y9viwp:VUjBD2BPwbPNrmAE+MqU
Score
10/10
Malware Config
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language csrss.exe -
Enumerates system info in registry 2 TTPs 32 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Identifier csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier csrss.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data csrss.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\1\KeyboardController csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral csrss.exe -
Modifies data under HKEY_USERS 9 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ThemeActive = "1" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastUserLangID = "1033" winlogon.exe Set value (data) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages = 65006e002d00550053000000 winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LoadedBefore = "1" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastLoadedDPI = "96" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\DllName = "%SystemRoot%\\resources\\themes\\Aero\\Aero.msstyles" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ColorName = "NormalColor" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\SizeName = "NormalSize" winlogon.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2544 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 2544 taskmgr.exe Token: SeShutdownPrivilege 2604 LogonUI.exe Token: SeShutdownPrivilege 2604 LogonUI.exe Token: SeSecurityPrivilege 2864 winlogon.exe Token: SeBackupPrivilege 2864 winlogon.exe Token: SeSecurityPrivilege 2864 winlogon.exe Token: SeTcbPrivilege 2864 winlogon.exe Token: SeShutdownPrivilege 2604 LogonUI.exe Token: SeSecurityPrivilege 2864 winlogon.exe Token: SeBackupPrivilege 2864 winlogon.exe Token: SeSecurityPrivilege 2864 winlogon.exe Token: SeShutdownPrivilege 2604 LogonUI.exe Token: SeSecurityPrivilege 2864 winlogon.exe Token: SeBackupPrivilege 2864 winlogon.exe Token: SeSecurityPrivilege 2864 winlogon.exe Token: SeShutdownPrivilege 2604 LogonUI.exe Token: SeSecurityPrivilege 2864 winlogon.exe Token: SeBackupPrivilege 2864 winlogon.exe Token: SeSecurityPrivilege 2864 winlogon.exe Token: SeShutdownPrivilege 2604 LogonUI.exe Token: SeSecurityPrivilege 2864 winlogon.exe Token: SeBackupPrivilege 2864 winlogon.exe Token: SeSecurityPrivilege 2864 winlogon.exe Token: SeShutdownPrivilege 2604 LogonUI.exe Token: SeSecurityPrivilege 2864 winlogon.exe Token: SeBackupPrivilege 2864 winlogon.exe Token: SeSecurityPrivilege 2864 winlogon.exe Token: SeShutdownPrivilege 2604 LogonUI.exe Token: SeSecurityPrivilege 2864 winlogon.exe Token: SeBackupPrivilege 2864 winlogon.exe Token: SeSecurityPrivilege 2864 winlogon.exe -
Suspicious use of FindShellTrayWindow 37 IoCs
pid Process 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe -
Suspicious use of SendNotifyMessage 36 IoCs
pid Process 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe 2544 taskmgr.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2540 wrote to memory of 1556 2540 Discord rat.exe 30 PID 2540 wrote to memory of 1556 2540 Discord rat.exe 30 PID 2540 wrote to memory of 1556 2540 Discord rat.exe 30 PID 2960 wrote to memory of 2604 2960 csrss.exe 37 PID 2960 wrote to memory of 2604 2960 csrss.exe 37 PID 2864 wrote to memory of 2604 2864 winlogon.exe 37 PID 2864 wrote to memory of 2604 2864 winlogon.exe 37 PID 2864 wrote to memory of 2604 2864 winlogon.exe 37 PID 2960 wrote to memory of 2604 2960 csrss.exe 37 PID 2960 wrote to memory of 2604 2960 csrss.exe 37 PID 2960 wrote to memory of 2604 2960 csrss.exe 37 PID 2960 wrote to memory of 2604 2960 csrss.exe 37 PID 2960 wrote to memory of 2604 2960 csrss.exe 37 PID 2960 wrote to memory of 2604 2960 csrss.exe 37 PID 2960 wrote to memory of 2604 2960 csrss.exe 37 PID 2960 wrote to memory of 2604 2960 csrss.exe 37 PID 2960 wrote to memory of 2604 2960 csrss.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\Release\Discord rat.exe"C:\Users\Admin\AppData\Local\Temp\Release\Discord rat.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2540 -s 5962⤵PID:1556
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2544
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:2808
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2960
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2604
-