Analysis

  • max time kernel
    147s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/11/2024, 17:21

General

  • Target

    DiscordCanarySetup.exe

  • Size

    103.7MB

  • MD5

    c6655f47c729a566381d757f4ccfca22

  • SHA1

    9a206d7bc2e999bc9549e283102957fdb7e1d6ac

  • SHA256

    7221d924450be7f8d162c813d7ab0fc7e5941e2481aea27e25183b518fa97f95

  • SHA512

    087965de9d95b8dff862bdb7fc691fc640c4d7df89735d3cf60a8799e8ae58477d5ccf7d887050d02a6a6f64f513805824589bbfea02e85d50329d5b4b4bf3d7

  • SSDEEP

    1572864:UnHD3RJgJ7HOVN8SWqQii3bOhjBd8DhKUpjCHgUasCac0agJc7wlrkubg2:CHD3AlHu2SDQybMK0uaHac0aJ7wlrk6B

Malware Config

Signatures

  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 11 IoCs
  • Modifies registry key 1 TTPs 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 61 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DiscordCanarySetup.exe
    "C:\Users\Admin\AppData\Local\Temp\DiscordCanarySetup.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1000
    • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
      "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3672
      • C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.328\DiscordCanary.exe
        "C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.328\DiscordCanary.exe" --squirrel-install 1.0.328
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2488
        • C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.328\DiscordCanary.exe
          C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.328\DiscordCanary.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discordcanary /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discordcanary\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.328 --annotation=plat=Win32 --annotation=prod=Electron --annotation=ver=31.2.1 --initial-client-data=0x53c,0x540,0x544,0x530,0x548,0x9c5d8dc,0x9c5d8e8,0x9c5d8f4
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1496
        • C:\Users\Admin\AppData\Local\DiscordCanary\Update.exe
          C:\Users\Admin\AppData\Local\DiscordCanary\Update.exe --createShortcut DiscordCanary.exe --setupIcon C:\Users\Admin\AppData\Local\DiscordCanary\app.ico
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:728
        • C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.328\DiscordCanary.exe
          "C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.328\DiscordCanary.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discordcanary" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1988,i,1671023170695555656,7053517772814600299,262144 --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:2
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:4112
        • C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.328\DiscordCanary.exe
          "C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.328\DiscordCanary.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discordcanary" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=2244,i,1671023170695555656,7053517772814600299,262144 --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:3
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:1160
        • C:\Windows\SysWOW64\reg.exe
          C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v DiscordCanary /d "\"C:\Users\Admin\AppData\Local\DiscordCanary\Update.exe\" --processStart DiscordCanary.exe" /f
          4⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies registry key
          PID:4952
        • C:\Windows\SysWOW64\reg.exe
          C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Modifies registry key
          PID:4488
        • C:\Windows\SysWOW64\reg.exe
          C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Modifies registry key
          PID:2044
        • C:\Windows\SysWOW64\reg.exe
          C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.328\DiscordCanary.exe\",-1" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Modifies registry key
          PID:1436
        • C:\Windows\SysWOW64\reg.exe
          C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.328\DiscordCanary.exe\" --url -- \"%1\"" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Modifies registry key
          PID:2220

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.328\app.ico

          Filesize

          278KB

          MD5

          b1177cead91e65699122ca293f51c478

          SHA1

          d306c44b148f59d4da8d7f5dde7cb14117b9a21e

          SHA256

          2dcb94cc54982584dd3137bf32c0757ae246757a66e8b45b9ac27829de729ea2

          SHA512

          1b71f11cb9c1cd0e38ac25abe4524d8a4785e0cc7d8e3b95258c4531255df362767e8bb685e84e0b9562838f047340ebb4fd5d692bb77618898348f07e9a480f

        • C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.328\chrome_100_percent.pak

          Filesize

          148KB

          MD5

          cb4f128469cd84711ed1c9c02212c7a8

          SHA1

          8ae60303be80b74163d5c4132de4a465a1eafc52

          SHA256

          7dd5485def22a53c0635efdf8ae900f147ec8c8a22b9ed71c24668075dd605d3

          SHA512

          0f0febe4ee321eb09d6a841fe3460d1f5b657b449058653111e7d0f7a9f36620b3d30369e367235948529409a6ce0ce625aede0c61b60926dec4d2c308306277

        • C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.328\chrome_200_percent.pak

          Filesize

          223KB

          MD5

          e9c1423fe5d139a4c88ba8b107573536

          SHA1

          46d3efe892044761f19844c4c4b8f9576f9ca43e

          SHA256

          2408969599d3953aae2fb36008e4d0711e30d0bc86fb4d03f8b0577d43c649fa

          SHA512

          abf8d4341c6de9c722168d0a9cf7d9bac5f491e1c9bedfe10b69096dcc2ef2cd08ff4d0e7c9b499c9d1f45fdb053eafc31add39d13c8287760f9304af0727bf4

        • C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.328\d3dcompiler_47.dll

          Filesize

          3.9MB

          MD5

          08ac37f455e0640c0250936090fe91b6

          SHA1

          7a91992d739448bc89e9f37a6b7efeb736efc43d

          SHA256

          2438b520ac961e38c5852779103734be373ee2b6d1e5a7a5d49248b52acc7c4d

          SHA512

          35a118f62b21160b0e7a92c7b9305da708c5cbd3491a724da330e3fc147dde2ca494387866c4e835f8e729b89ee0903fd1b479fcc75b9e516df8b86a2f1364c8

        • C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.328\ffmpeg.dll

          Filesize

          3.0MB

          MD5

          70e28b85d6f7c4a52cc0a21ac6f6ab2e

          SHA1

          f51921ba47b1a9dfca1f8dc8fcc1427e40226fda

          SHA256

          34ca6fad702e41713316e8a0e40364541d29e33bf112db4108629e4d2d6e08ce

          SHA512

          e6ad5728d76cfcdfaa67267792f46bc2230d425411f802a1a16ad2076ec93059c8ca6e6fa887ba398bdd6cb3a99dcb9f6d8076354844a7c32225c663171c0a13

        • C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.328\icudtl.dat

          Filesize

          10.0MB

          MD5

          ffd67c1e24cb35dc109a24024b1ba7ec

          SHA1

          99f545bc396878c7a53e98a79017d9531af7c1f5

          SHA256

          9ae98c06cbb0ea43c5cd6b5725310c008c65e46072421a1118cb88e1de9a8b92

          SHA512

          e1a865e685d2d3bacd0916d4238a79462519d887feb273a251120bb6af2b4481d025f3b21ce9a1a95a49371a0aa3ecf072175ba756974e831dbfde1f0feaeb79

        • C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.328\libegl.dll

          Filesize

          389KB

          MD5

          d0dffea06164554ef074473f39762b00

          SHA1

          cc125b4a25b863ca3e5e948c5d358d92d58027d9

          SHA256

          af2f97a6ebb399dd697b5cb3b59a01d31f12ecf6ad37babbdd5ade3fb5b032cc

          SHA512

          e0ab8c61360ce2914452c1230e51c346ef957214d68227b24724b81c5f0a1011feb91d1d6b84285c0d06615ba420197269b6f10440309dc6f8e0d9eebb700e09

        • C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.328\libglesv2.dll

          Filesize

          6.7MB

          MD5

          41be166661e5a050c0772a61fd883fb2

          SHA1

          3b540c099aa2643baa7514131260697298310807

          SHA256

          45798dfdc089e613c8b9ab89a5a2b3f860c855b3a2fd43af89b99b9be5db0b47

          SHA512

          5cf7a6b03cc69ca044831b797b7b4b420be34d93a903dc1c8bfeda7f81e73f67f4adcf008f314a71bac4c003929eda053eff578e65988c2b300fcaeb9c6cf08d

        • C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.328\locales\en-US.pak

          Filesize

          454KB

          MD5

          9bce1a4c9a06d63e8b4f7eb40535c080

          SHA1

          11bc263876228d22b0bee57c6ba80c523c79e5cc

          SHA256

          0013a8efed8a17a93b0e718fb41652b8a2a6ed38128575cee89a258134167e41

          SHA512

          b6d1ea3a81cb1b32eba16a1cb4f337cbd15f28efea1e31ebf12efb795c33f6eea70abbfa4fed1b241103a8f0865cb2dd138db598c9cfbdce34497d46119e7566

        • C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.328\resources.pak

          Filesize

          5.3MB

          MD5

          deaa8cf598b837b6edcd40cff3f47dae

          SHA1

          32e85997f4bf0355c105ffcb2403031585b306f5

          SHA256

          fd880b5f823ee0ed0e143eb3aa542279026317e037e2ab45b3c053245cf97e8b

          SHA512

          1811d294bdb5baa27f7d8f7864cc8f5eb7a35c16c439f995240228c7a91fad936edb844721b03442a1f7687c51c71d31ef28917df758546c1adbca54e6b24c5b

        • C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.328\resources\app.asar

          Filesize

          7.6MB

          MD5

          5858be90a23a3bb63426ce1a5a7d9066

          SHA1

          8c6b4f37a9a04cfee54d7ad2dcee5f42d678d572

          SHA256

          78880e2db0ca22d389f31e1f0983a5979fec82ec5af28462fb84b584ec7a339c

          SHA512

          51eceaa5e529453e50b800d14790ce7ffc8edf192720c20ba49a27f9384a88bb2a8e00c335b5a6efe223518136338a314f0c20aa093791093a3e23e56a42115f

        • C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.328\resources\build_info.json

          Filesize

          82B

          MD5

          279e481496cfa482d1e07cea293e9c6d

          SHA1

          f449153aa758c42dd4a7a73f0a5279b1c40e59b6

          SHA256

          074c350fdfaf095d3999a21e4d2c8e9ede1e7d980fde86a5aa4935183b09e8ae

          SHA512

          6cd03d4f5affdfb6d6e2f7eb9dd9344e6c163ce4656ee7b04c673aed9a8f12f05a0edbbec31aa6f309ea123513a347a4aa9d1966c8d56d71591ab62a9e2f5fbf

        • C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.328\v8_context_snapshot.bin

          Filesize

          648KB

          MD5

          f865716fe0d06505b9f5178877c03c09

          SHA1

          762be5046afdb41d65113fc0c6db4e5ee3602574

          SHA256

          4345194273b40a62e83fb6d1067a7ed5daf310470fa2220ac891fbb126fe1041

          SHA512

          c859b94687a2d595f4060c9a49d3bae0d2044fe10058c73f49a2306d9e08e50c1ab24f8ff7d72f397d7d729839518077e243276d04b225e49517c04969cfed76

        • C:\Users\Admin\AppData\Local\DiscordCanary\app-1.0.328\vk_swiftshader.dll

          Filesize

          4.6MB

          MD5

          458d1070882afb5bd9760f83438e9165

          SHA1

          c6ed9f44e0736d2ba8643cee08edb424350ecd06

          SHA256

          5010111d98b68a62d01e40b1ef4377139ec19b4c443a1a5a14e0b52b95b316b8

          SHA512

          024f14864e0cccc6286b462853a61498946a4d2f4c59323da42fe8cbb4105326387ea04276fc634290a2ceb9fb5beb75968fc45a1cf8ccc56940e641b5e5043d

        • C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES

          Filesize

          86B

          MD5

          62ff6ef904f14f87221598ce63893e77

          SHA1

          7ce130c46f34c31ef97d7296a272ed3148326de1

          SHA256

          0577e637242b42488abe9cec3a5014bd4c89707dc085e527100f760f53938b78

          SHA512

          3ad201fa706012ff376d4672cca5e4e14e128eaec1ca573505ee7130647a76cabe9aa86703bf0453b8a24c8a8a50bdf7ca5509c38a46e3aa615d449e4fbf84d7

        • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe

          Filesize

          1.5MB

          MD5

          f6a4d597916c5f4bdaec6553f8e0f8a4

          SHA1

          cfe432ced144a6901fc421753d3b739be4c6a4e6

          SHA256

          b6ed43277d7b382ca1d841b3cbcd910e5405d962807cb33477b4db0a90b92b66

          SHA512

          a1de2f639c2f40a196723a827aaa1deeb1c0cbcc61b6afca35b01794ad546565d394c6010aec3179d187e2bbf8f707b74cefd9d152584eb9edf91061ad30028b

        • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

          Filesize

          2B

          MD5

          f3b25701fe362ec84616a93a45ce9998

          SHA1

          d62636d8caec13f04e28442a0a6fa1afeb024bbb

          SHA256

          b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

          SHA512

          98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

        • memory/728-219-0x0000000004AF0000-0x0000000004B10000-memory.dmp

          Filesize

          128KB

        • memory/3672-193-0x00000000111B0000-0x00000000111BE000-memory.dmp

          Filesize

          56KB

        • memory/3672-192-0x00000000111D0000-0x0000000011208000-memory.dmp

          Filesize

          224KB

        • memory/3672-191-0x0000000010950000-0x0000000010958000-memory.dmp

          Filesize

          32KB

        • memory/3672-9-0x00000000002B0000-0x0000000000426000-memory.dmp

          Filesize

          1.5MB