discordrat | 9da14eafeaff261c893fe5e252ecee52465c403325b9c3ba761e5d80ca76866a

Resubmissions

03-11-2024 00:29

241103-atdf2syray 10

03-11-2024 00:27

03-11-2024 00:23

03-11-2024 00:19

03-11-2024 00:16

03-11-2024 00:11

Analysis

max time kernel
127s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-11-2024 00:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

do not download and run.exe
Size

78KB
MD5

f2c5e50d71723a255faafb127396b119
SHA1

5784b322726fe05abae13b8dde3c6bcb10eaf83f
SHA256

9da14eafeaff261c893fe5e252ecee52465c403325b9c3ba761e5d80ca76866a
SHA512

5a955fca58d1f105d5ffe6004b18e013f69dbf0a06538d5c6192e9964e7249a7cbb8335411b263d56cb8108bf610f29f4c848c0d38f0c68bcfac73bb0a341259
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+APIC:5Zv5PDwbjNrmAE+kIC

Score

10^/10

discordrat persistence ransomware rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMwMjMwNTMyNzY2MzkzOTcyNg.GkZ69I.EmDu656kW3-o_fxbEajqbFdrqzR7r2g-hNmbM0
server_id
1302304456985149450

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

do not download and run.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	do not download and run.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

Processes:

flow	ioc
19	discord.com
40	discord.com
61	discord.com
82	discord.com
9	discord.com
42	discord.com
43	discord.com
59	discord.com
60	discord.com
66	discord.com
67	discord.com
6	discord.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

do not download and run.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpDE98.tmp.png"	do not download and run.exe

Drops file in Windows directory 1 IoCs

Processes:

LogonUI.exe

description	ioc	Process
File created	C:\Windows\rescache\_merged\2229298842\724624314.pri	LogonUI.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "218"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

do not download and run.exe

description	pid	Process
Token: SeDebugPrivilege	2608	do not download and run.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

do not download and run.exeLogonUI.exe

pid	Process
2608	do not download and run.exe
2608	do not download and run.exe
2608	do not download and run.exe
2608	do not download and run.exe
4188	LogonUI.exe
4188	LogonUI.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

do not download and run.exe

description	pid	Process	procid_target
PID 2608 wrote to memory of 4428	2608	do not download and run.exe	118
PID 2608 wrote to memory of 4428	2608	do not download and run.exe	118

C:\Users\Admin\AppData\Local\Temp\do not download and run.exe
"C:\Users\Admin\AppData\Local\Temp\do not download and run.exe"
1⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\System32\shutdown.exe
  "C:\Windows\System32\shutdown.exe" /L
  2⤵
  PID:4428

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe"
1⤵
PID:3308

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3934855 /state1:0x41c64e6d
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2608-0-0x00007FFC53833000-0x00007FFC53835000-memory.dmp

Filesize
8KB

Download
memory/2608-1-0x000002395E6F0000-0x000002395E708000-memory.dmp

Filesize
96KB

Download
memory/2608-2-0x0000023978D80000-0x0000023978F42000-memory.dmp

Filesize
1.8MB

Download
memory/2608-3-0x00007FFC53830000-0x00007FFC542F1000-memory.dmp

Filesize
10.8MB

Download
memory/2608-4-0x0000023979580000-0x0000023979AA8000-memory.dmp

Filesize
5.2MB

Download
memory/2608-5-0x00007FFC53833000-0x00007FFC53835000-memory.dmp

Filesize
8KB

Download
memory/2608-6-0x00007FFC53830000-0x00007FFC542F1000-memory.dmp

Filesize
10.8MB

Download
memory/2608-9-0x00007FFC53830000-0x00007FFC542F1000-memory.dmp

Filesize
10.8MB

Download