Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows11-21h2_x64 -
resource
win11-20241023-en -
resource tags
arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system -
submitted
20-11-2024 14:53
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win11-20241023-en
windows11-21h2-x64
14 signatures
150 seconds
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
5294e84c734fbf9f34110e233b094b98
-
SHA1
2a2dc9fa78e3c80f7c425dc2d70daad6e0e2f6c2
-
SHA256
4abd3eb46f7ea1d4f698e5e35f6ce12cffbc131c994f842733aa4a4a6fc1654a
-
SHA512
ac67c08d7e1eb2d0c8b5f8928541c423d249094bbb72bf920a365f2afe9e3a034923c14cc9a667a899dcc4691b79c45b7eb352acd7f2e08a75bcbabe4cef2bcd
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+pPIC:5Zv5PDwbjNrmAE+ZIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTMwODc5Nzk2NTYxNTQ5NzM1Nw.GBpC5A.89Z5f6lFNt0ykOCJ3xjQcB6vyTHT36DHCa_Du0
-
server_id
1308798365948969031
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies data under HKEY_USERS 15 IoCs
Processes:
LogonUI.exedescription ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "65" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe -
Modifies registry class 1 IoCs
Processes:
taskmgr.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
taskmgr.exepid Process 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe -
Suspicious behavior: LoadsDriver 64 IoCs
Processes:
pid Process 5060 1064 908 1944 992 1384 1280 3896 572 3028 3684 4024 3740 3776 4916 3208 3744 2884 4932 1980 876 3348 2480 2992 1116 2472 976 1460 5080 4240 1476 2564 1352 5008 2200 2980 3988 3540 4288 776 3572 1132 868 2308 3736 2792 4600 2444 4908 1668 4316 5044 3548 3692 3460 3432 3544 2764 3564 3024 4692 4976 4856 4672 -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Client-built.exetaskmgr.exedescription pid Process Token: SeDebugPrivilege 4516 Client-built.exe Token: SeDebugPrivilege 1344 taskmgr.exe Token: SeSystemProfilePrivilege 1344 taskmgr.exe Token: SeCreateGlobalPrivilege 1344 taskmgr.exe -
Suspicious use of FindShellTrayWindow 40 IoCs
Processes:
taskmgr.exepid Process 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe -
Suspicious use of SendNotifyMessage 40 IoCs
Processes:
taskmgr.exepid Process 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
LogonUI.exepid Process 3916 LogonUI.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
Client-built.exedescription pid Process procid_target PID 4516 wrote to memory of 2744 4516 Client-built.exe 82 PID 4516 wrote to memory of 2744 4516 Client-built.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\System32\shutdown.exe"C:\Windows\System32\shutdown.exe" /L2⤵PID:2744
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1344
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1220
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39ce855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3916