discordrat | hxxps://mega[.]nz/folder/AeMzGRyZ#xTt-KzNRdV527KKpj7dHuQ

Analysis

max time kernel
57s
max time network
57s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2024 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://mega.nz/folder/AeMzGRyZ#xTt-KzNRdV527KKpj7dHuQ

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Executes dropped EXE 1 IoCs

Processes:

Discord rat.exe

pid	Process
6120	Discord rat.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

Processes:

OpenWith.exemsedge.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 668162.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exetaskmgr.exemsedge.exe

pid	Process
4588	msedge.exe
4588	msedge.exe
988	msedge.exe
988	msedge.exe
1324	identity_helper.exe
1324	identity_helper.exe
6016	msedge.exe
6016	msedge.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
396	msedge.exe
396	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid	Process
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

AUDIODG.EXEDiscord rat.exetaskmgr.exe

description	pid	Process
Token: 33	4120	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4120	AUDIODG.EXE
Token: SeDebugPrivilege	6120	Discord rat.exe
Token: SeDebugPrivilege	6012	taskmgr.exe
Token: SeSystemProfilePrivilege	6012	taskmgr.exe
Token: SeCreateGlobalPrivilege	6012	taskmgr.exe
Token: 33	6012	taskmgr.exe
Token: SeIncBasePriorityPrivilege	6012	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exetaskmgr.exe

pid	Process
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe

Suspicious use of SendNotifyMessage 63 IoCs

Processes:

msedge.exetaskmgr.exe

pid	Process
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
988	msedge.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe
6012	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid	Process
4332	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	Process	procid_target
PID 988 wrote to memory of 3836	988	msedge.exe	87
PID 988 wrote to memory of 3836	988	msedge.exe	87
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 976	988	msedge.exe	88
PID 988 wrote to memory of 4588	988	msedge.exe	89
PID 988 wrote to memory of 4588	988	msedge.exe	89
PID 988 wrote to memory of 2680	988	msedge.exe	90
PID 988 wrote to memory of 2680	988	msedge.exe	90
PID 988 wrote to memory of 2680	988	msedge.exe	90
PID 988 wrote to memory of 2680	988	msedge.exe	90
PID 988 wrote to memory of 2680	988	msedge.exe	90
PID 988 wrote to memory of 2680	988	msedge.exe	90
PID 988 wrote to memory of 2680	988	msedge.exe	90
PID 988 wrote to memory of 2680	988	msedge.exe	90
PID 988 wrote to memory of 2680	988	msedge.exe	90
PID 988 wrote to memory of 2680	988	msedge.exe	90
PID 988 wrote to memory of 2680	988	msedge.exe	90
PID 988 wrote to memory of 2680	988	msedge.exe	90
PID 988 wrote to memory of 2680	988	msedge.exe	90
PID 988 wrote to memory of 2680	988	msedge.exe	90
PID 988 wrote to memory of 2680	988	msedge.exe	90
PID 988 wrote to memory of 2680	988	msedge.exe	90
PID 988 wrote to memory of 2680	988	msedge.exe	90
PID 988 wrote to memory of 2680	988	msedge.exe	90
PID 988 wrote to memory of 2680	988	msedge.exe	90
PID 988 wrote to memory of 2680	988	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://mega.nz/folder/AeMzGRyZ#xTt-KzNRdV527KKpj7dHuQ
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf39d46f8,0x7ffaf39d4708,0x7ffaf39d4718
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,9424453652951348304,7355931044925045563,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,9424453652951348304,7355931044925045563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,9424453652951348304,7355931044925045563,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9424453652951348304,7355931044925045563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9424453652951348304,7355931044925045563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,9424453652951348304,7355931044925045563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,9424453652951348304,7355931044925045563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2064,9424453652951348304,7355931044925045563,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9424453652951348304,7355931044925045563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9424453652951348304,7355931044925045563,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9424453652951348304,7355931044925045563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9424453652951348304,7355931044925045563,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2064,9424453652951348304,7355931044925045563,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9424453652951348304,7355931044925045563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:5768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2064,9424453652951348304,7355931044925045563,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:5892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,9424453652951348304,7355931044925045563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6016
- C:\Users\Admin\Downloads\Discord rat.exe
  "C:\Users\Admin\Downloads\Discord rat.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:6120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,9424453652951348304,7355931044925045563,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2064,9424453652951348304,7355931044925045563,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2332

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x318 0x2d4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4120

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6012

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
3578e040d614701755f389ae34b57f7c

SHA1
edfcf1b315af5c3ca012db6259268ec57d39704b

SHA256
0f0536d70ca5088c3d06e2b6ff76ee91ef4973b11a6b4633415b0db6454719a0

SHA512
bd4cd9de63f8c9fc294e833102a19e85865b880efaf9800b5fb6c343e15374c5d1d95ea617018e88f248752961a45ac1c825141c8ac330b8a8c821c3d2c88e51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7538001c0483bf64b1652ed17ca32862

SHA1
a46f1eb9aa9a4e7da968a7b59de0a5fc13c5fef8

SHA256
ae9bce9e06e3220a5940a7af80b4551d6459e78fec315c6fe4b3cd54e9b73d62

SHA512
0e4ccbf0a5db3f3a1e272ce8915c7c2c7743a745f4cc5595c2d3d758750c7c01611f1d56e286149d6543739514756b83a3381d0e796e2536b65ee2023e1cbdf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f1745e68716e926fa6c283ed4fb1ce3b

SHA1
329de83182852a1817a6d741e46c139ae1243b84

SHA256
d105a4a2a4591e6f61038d9928ad372af4e720e6d595e01ca8524e09a47cfb64

SHA512
f82834cf624a2ff1618fa6cccba5caff7148f37eaa70edc5eac4d84914b1d9af3ad69c928eb3e38d8e8cb9f4d53630d4f65daa24345eca1da8b809a8aba366b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
17f36db433e4dc3b1bc0275acd492063

SHA1
4b97b85ee4fee3927e39a2dbe418ed254f4d3eca

SHA256
1d96ff8f3efe6d1a85cacb755a536c32bf21748a55ce5f20c3cfb44e80e8d249

SHA512
141d97bec3b8619162ead652d093fb39be0e975256f779468e72126c123d37db31d256842c6f218c07feae4f30a0c326f6e531e7b81655ad965a3fd1c35b0ab1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
08c338e364d0f230f72c0301207c1493

SHA1
737a492df5c894fee9397c56fb116c10f1c5175d

SHA256
2962fe2f678ebf01bfca093f53c1921a5a228325e4cedf2a182d05d95d86647c

SHA512
d7f0811118e2ea2b6fdb0daefc0498c7e094ebbba78c9291d58c314a9bcc2fc0229f4eb5bce504c8ad137bbbdc00a3cef1715b0cae5a5733eaa1fc6619fcb036

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58211f.TMP

Filesize
48B

MD5
e1e80a8547bd1682413120f225849395

SHA1
50c7bd2961c519f4de7f75b7f7d7ffff9fbc1eb3

SHA256
659ec1d37e52077eae2fa4aabc68da93368efcb0062e8e121772eec882b7551b

SHA512
51f5705a2e6d41b2968b60363f9ba01442c456b560a4165f5857ca7a9a677aeb2c36c4b01fa0326b6aa78c3e4773657a20c950194e88f9907b1111941e423191

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
150f252b07c71388bc3af2c4fe4903ec

SHA1
0bf5aa76d3a5d34807e025fb5d1981d56b5ee03e

SHA256
ea0a524c5b7937684b608acbc930ceb9c7479ed08b32caa34bda6f5194e98548

SHA512
3d4579de0eb080ba24936d350c0b80624ff84336fd23a918bac6d1c64fe9c091440676f1e04000bff9c34a201dec14fa97ea1bba27daf9c36ac59afb0ec9f02a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9614a6a2707e7ccbeeb36224aed51c89

SHA1
2ad62e36dd256237dc58b7603856746379775339

SHA256
8daaf78382faab43391b45cef505ea4c532151f9a62a40da850545ef64058997

SHA512
858cf7761c46d6546801f85ebc0bc922b8e3df9740c461b429074e90095557a9ff5e163ffbf7ca9a909bb2f12627b662b29f74916a940402e5a6a42adc2d7ee6

Download Submit
C:\Users\Admin\Downloads\Discord rat.exe

Filesize
79KB

MD5
d13905e018eb965ded2e28ba0ab257b5

SHA1
6d7fe69566fddc69b33d698591c9a2c70d834858

SHA256
2bd631c6665656673a923c13359b0dc211debc05b2885127e26b0dce808e2dec

SHA512
b95bfdebef33ac72b6c21cdf0abb4961222b7efd17267cd7236e731dd0b6105ece28e784a95455f1ffc8a6dd1d580a467b07b3bd8cb2fb19e2111f1a864c97cb

Download Submit
C:\Users\Admin\Downloads\Discord rat.rar

Filesize
26KB

MD5
0b1fc253513bfd5ca8aea8734edb6843

SHA1
f3e85ee7790e29640ff8881c04a9e6b7fd6a9676

SHA256
ce46f6dadd471a17b9e52c3c2363cc203095f852da4c8f47fa1da4ce46bd3b31

SHA512
079b21142d476f0895dece167138f2e6d358b0ef6c20d796c086d49b45c9979f5b57356a90896d94b10691a0016f056ccd9b6ff942aa80c5713de8f468f2e978

Download Submit
\??\pipe\LOCAL\crashpad_988_GFPCZWNJHLCHQDGG

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/6012-242-0x000001E116070000-0x000001E116071000-memory.dmp

Filesize
4KB

Download
memory/6012-233-0x000001E116070000-0x000001E116071000-memory.dmp

Filesize
4KB

Download
memory/6012-232-0x000001E116070000-0x000001E116071000-memory.dmp

Filesize
4KB

Download
memory/6012-231-0x000001E116070000-0x000001E116071000-memory.dmp

Filesize
4KB

Download
memory/6012-243-0x000001E116070000-0x000001E116071000-memory.dmp

Filesize
4KB

Download
memory/6012-241-0x000001E116070000-0x000001E116071000-memory.dmp

Filesize
4KB

Download
memory/6012-240-0x000001E116070000-0x000001E116071000-memory.dmp

Filesize
4KB

Download
memory/6012-239-0x000001E116070000-0x000001E116071000-memory.dmp

Filesize
4KB

Download
memory/6012-238-0x000001E116070000-0x000001E116071000-memory.dmp

Filesize
4KB

Download
memory/6012-237-0x000001E116070000-0x000001E116071000-memory.dmp

Filesize
4KB

Download
memory/6120-212-0x0000021DF9760000-0x0000021DF9C88000-memory.dmp

Filesize
5.2MB

Download
memory/6120-210-0x0000021DDE900000-0x0000021DDE918000-memory.dmp

Filesize
96KB

Download
memory/6120-211-0x0000021DF8F60000-0x0000021DF9122000-memory.dmp

Filesize
1.8MB

Download