Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows11-21h2_x64 -
resource
win11-20241023-en -
resource tags
arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system -
submitted
20-11-2024 14:53
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win11-20241023-en
windows11-21h2-x64
14 signatures
150 seconds
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
5294e84c734fbf9f34110e233b094b98
-
SHA1
2a2dc9fa78e3c80f7c425dc2d70daad6e0e2f6c2
-
SHA256
4abd3eb46f7ea1d4f698e5e35f6ce12cffbc131c994f842733aa4a4a6fc1654a
-
SHA512
ac67c08d7e1eb2d0c8b5f8928541c423d249094bbb72bf920a365f2afe9e3a034923c14cc9a667a899dcc4691b79c45b7eb352acd7f2e08a75bcbabe4cef2bcd
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+pPIC:5Zv5PDwbjNrmAE+ZIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTMwODc5Nzk2NTYxNTQ5NzM1Nw.GBpC5A.89Z5f6lFNt0ykOCJ3xjQcB6vyTHT36DHCa_Du0
-
server_id
1308798365948969031
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 1 discord.com 4 discord.com 6 discord.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "65" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4248760313-3670024077-2384670640-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe -
Suspicious behavior: LoadsDriver 64 IoCs
pid Process 5060 Process not Found 1064 Process not Found 908 Process not Found 1944 Process not Found 992 Process not Found 1384 Process not Found 1280 Process not Found 3896 Process not Found 572 Process not Found 3028 Process not Found 3684 Process not Found 4024 Process not Found 3740 Process not Found 3776 Process not Found 4916 Process not Found 3208 Process not Found 3744 Process not Found 2884 Process not Found 4932 Process not Found 1980 Process not Found 876 Process not Found 3348 Process not Found 2480 Process not Found 2992 Process not Found 1116 Process not Found 2472 Process not Found 976 Process not Found 1460 Process not Found 5080 Process not Found 4240 Process not Found 1476 Process not Found 2564 Process not Found 1352 Process not Found 5008 Process not Found 2200 Process not Found 2980 Process not Found 3988 Process not Found 3540 Process not Found 4288 Process not Found 776 Process not Found 3572 Process not Found 1132 Process not Found 868 Process not Found 2308 Process not Found 3736 Process not Found 2792 Process not Found 4600 Process not Found 2444 Process not Found 4908 Process not Found 1668 Process not Found 4316 Process not Found 5044 Process not Found 3548 Process not Found 3692 Process not Found 3460 Process not Found 3432 Process not Found 3544 Process not Found 2764 Process not Found 3564 Process not Found 3024 Process not Found 4692 Process not Found 4976 Process not Found 4856 Process not Found 4672 Process not Found -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4516 Client-built.exe Token: SeDebugPrivilege 1344 taskmgr.exe Token: SeSystemProfilePrivilege 1344 taskmgr.exe Token: SeCreateGlobalPrivilege 1344 taskmgr.exe -
Suspicious use of FindShellTrayWindow 40 IoCs
pid Process 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe -
Suspicious use of SendNotifyMessage 40 IoCs
pid Process 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe 1344 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3916 LogonUI.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4516 wrote to memory of 2744 4516 Client-built.exe 82 PID 4516 wrote to memory of 2744 4516 Client-built.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\System32\shutdown.exe"C:\Windows\System32\shutdown.exe" /L2⤵PID:2744
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1344
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1220
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39ce855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3916