Analysis
-
max time kernel
1593s -
max time network
1798s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
04-11-2024 16:28
Behavioral task
behavioral1
Sample
WinSysUpdater.exe
Resource
win11-20241007-en
windows11-21h2-x64
13 signatures
1800 seconds
General
-
Target
WinSysUpdater.exe
-
Size
78KB
-
MD5
3a7ba5dc9dc4440dfda51f6b896bf8d4
-
SHA1
e9b9929636b6956123d9c5e3b97e794c34ee144d
-
SHA256
ec705050788da27ba95d24a7193bba431a2c269e76a8d43de1fc7fc4de49a833
-
SHA512
9f53d5798955422148461c375cbc5eed9c84be71576fb93e0a07c3a0a5c35e89608d248d2c516903a0fce8b79106042b0046147dd6f13cafdcd86928219e766c
-
SSDEEP
1536:c2WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+6PIm:cZv5PDwbjNrmAE+mIm
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTMwMjgzMDcxMjAxNzM4NzU3Mg.GyQnUS.SxpKuBXZ9K_mg_8_GUInFqHsiwyeBPIua6YOAA
-
server_id
1302293783269867540
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs
Processes:
flow ioc 1 discord.com 6 discord.com 8 discord.com 19 discord.com 3 discord.com 5 discord.com 7 discord.com 9 discord.com 10 discord.com 18 discord.com -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Processes:
taskmgr.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Internet Explorer\TypedURLs taskmgr.exe -
Modifies registry class 4 IoCs
Processes:
BackgroundTransferHost.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" BackgroundTransferHost.exe Key created \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\MuiCache BackgroundTransferHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix BackgroundTransferHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" BackgroundTransferHost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exepid Process 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid Process 2384 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
WinSysUpdater.exetaskmgr.exedescription pid Process Token: SeDebugPrivilege 1084 WinSysUpdater.exe Token: SeDebugPrivilege 2384 taskmgr.exe Token: SeSystemProfilePrivilege 2384 taskmgr.exe Token: SeCreateGlobalPrivilege 2384 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid Process 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid Process 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe 2384 taskmgr.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
taskmgr.exedescription pid Process procid_target PID 2384 wrote to memory of 4996 2384 taskmgr.exe 83 PID 2384 wrote to memory of 4996 2384 taskmgr.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\WinSysUpdater.exe"C:\Users\Admin\AppData\Local\Temp\WinSysUpdater.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1084
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\system32\winver.exe"C:\Windows\system32\winver.exe"2⤵PID:4996
-
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.131⤵
- Modifies registry class
PID:4024
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\bc8ab9ca-159e-439b-89c4-405e14cc26f4.down_data
Filesize555KB
MD55683c0028832cae4ef93ca39c8ac5029
SHA1248755e4e1db552e0b6f8651b04ca6d1b31a86fb
SHA256855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e
SHA512aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3