Analysis
-
max time kernel
24s -
max time network
21s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
20-11-2024 20:50
Behavioral task
behavioral1
Sample
release (1).zip
Resource
win10ltsc2021-20241023-en
General
-
Target
release (1).zip
-
Size
445KB
-
MD5
06a4fcd5eb3a39d7f50a0709de9900db
-
SHA1
50d089e915f69313a5187569cda4e6dec2d55ca7
-
SHA256
c13a0cd7c2c2fd577703bff026b72ed81b51266afa047328c8ff1c4a4d965c97
-
SHA512
75e5f637fd3282d088b1c0c1efd0de8a128f681e4ac66d6303d205471fe68b4fbf0356a21d803aff2cca6def455abad8619fedc8c7d51e574640eda0df561f9b
-
SSDEEP
12288:BfJ13+GoLo2d5ifXHE8134QwYOwFSFRiLQI:BKGo8EifSQwYWI
Malware Config
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Executes dropped EXE 2 IoCs
pid Process 4416 builder.exe 4224 Discord rat.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language builder.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4640 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 4640 7zFM.exe Token: 35 4640 7zFM.exe Token: SeSecurityPrivilege 4640 7zFM.exe Token: SeDebugPrivilege 4224 Discord rat.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4640 7zFM.exe 4640 7zFM.exe 4416 builder.exe
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\release (1).zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4640
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:220
-
C:\Users\Admin\Desktop\New folder\builder.exe"C:\Users\Admin\Desktop\New folder\builder.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
PID:4416
-
C:\Users\Admin\Desktop\New folder\Release\Discord rat.exe"C:\Users\Admin\Desktop\New folder\Release\Discord rat.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4224
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
79KB
MD5d13905e018eb965ded2e28ba0ab257b5
SHA16d7fe69566fddc69b33d698591c9a2c70d834858
SHA2562bd631c6665656673a923c13359b0dc211debc05b2885127e26b0dce808e2dec
SHA512b95bfdebef33ac72b6c21cdf0abb4961222b7efd17267cd7236e731dd0b6105ece28e784a95455f1ffc8a6dd1d580a467b07b3bd8cb2fb19e2111f1a864c97cb
-
Filesize
10KB
MD54f04f0e1ff050abf6f1696be1e8bb039
SHA1bebf3088fff4595bfb53aea6af11741946bbd9ce
SHA256ded51c306ee7e59fa15c42798c80f988f6310ea77ab77de3d12dc01233757cfa
SHA51294713824b81de323e368fde18679ef8b8f2883378bffd2b7bd2b4e4bd5d48b35c6e71c9f8e9b058ba497db1bd0781807e5b7cecfd540dad611da0986c72b9f12