discordrat | 5ea6afa4f123b4ea918aacafa133309a4850a3cf7cf7ee503e7712aaae893992

Analysis

max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
11-12-2024 23:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client-built.exe
Size

78KB
MD5

3eb92b8497ddfee8e43939e890bf1976
SHA1

18aa6df7c8cc8f773f0bc9bec8d631c44fee4c5d
SHA256

5ea6afa4f123b4ea918aacafa133309a4850a3cf7cf7ee503e7712aaae893992
SHA512

cd40e0103e0f9f9669cd07139b60df631506931bd93c4d1f4ab3e2ab5ad2c488c56b465bec6d293dceb9b107b478a7545ad84a1b6db75b44441911ef4e3fb2c2
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+2PIC:5Zv5PDwbjNrmAE+yIC

Score

10^/10

discordrat discovery evasion persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMxNjUzMzkwMTg5MTYwNDU1MA.GI7iob.pcLDsMYuxjZxVDoarIHuAYwRBVhdbFfMxNY8K0
server_id
1316541708548313231

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat
Disables Task Manager via registry modification
evasion

Legitimate hosting services abused for malware hosting/C2 1 TTPs 8 IoCs

Web Service

T1102

flow	ioc
6	discord.com
7	discord.com
8	discord.com
9	discord.com
13	discord.com
27	discord.com
1	discord.com
3	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2410826464-2353372766-2364966905-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3480	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2592	msedge.exe
2592	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
4616	identity_helper.exe
4616	identity_helper.exe
392	msedge.exe
392	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4484	Client-built.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4484 wrote to memory of 3480	4484	Client-built.exe	77
PID 4484 wrote to memory of 3480	4484	Client-built.exe	77
PID 2400 wrote to memory of 1564	2400	msedge.exe	84
PID 2400 wrote to memory of 1564	2400	msedge.exe	84
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 4652	2400	msedge.exe	85
PID 2400 wrote to memory of 2592	2400	msedge.exe	86
PID 2400 wrote to memory of 2592	2400	msedge.exe	86
PID 2400 wrote to memory of 2984	2400	msedge.exe	87
PID 2400 wrote to memory of 2984	2400	msedge.exe	87
PID 2400 wrote to memory of 2984	2400	msedge.exe	87
PID 2400 wrote to memory of 2984	2400	msedge.exe	87
PID 2400 wrote to memory of 2984	2400	msedge.exe	87
PID 2400 wrote to memory of 2984	2400	msedge.exe	87
PID 2400 wrote to memory of 2984	2400	msedge.exe	87
PID 2400 wrote to memory of 2984	2400	msedge.exe	87
PID 2400 wrote to memory of 2984	2400	msedge.exe	87
PID 2400 wrote to memory of 2984	2400	msedge.exe	87
PID 2400 wrote to memory of 2984	2400	msedge.exe	87
PID 2400 wrote to memory of 2984	2400	msedge.exe	87
PID 2400 wrote to memory of 2984	2400	msedge.exe	87
PID 2400 wrote to memory of 2984	2400	msedge.exe	87
PID 2400 wrote to memory of 2984	2400	msedge.exe	87
PID 2400 wrote to memory of 2984	2400	msedge.exe	87
PID 2400 wrote to memory of 2984	2400	msedge.exe	87
PID 2400 wrote to memory of 2984	2400	msedge.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client-built.exe
"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4484
- C:\Windows\SYSTEM32\SCHTASKS.exe
  "SCHTASKS.exe" /create /tn "$77Client-built.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\Client-built.exe'" /sc onlogon /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdc3933cb8,0x7ffdc3933cc8,0x7ffdc3933cd8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,6380056845094344876,800472057716757509,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1876 /prefetch:2
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1868,6380056845094344876,800472057716757509,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1868,6380056845094344876,800472057716757509,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,6380056845094344876,800472057716757509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,6380056845094344876,800472057716757509,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,6380056845094344876,800472057716757509,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,6380056845094344876,800472057716757509,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4524 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1868,6380056845094344876,800472057716757509,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4664 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1868,6380056845094344876,800472057716757509,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3684 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4160

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1fc959921446fa3ab5813f75ca4d0235

SHA1
0aeef3ba7ba2aa1f725fca09432d384b06995e2a

SHA256
1b1e89d3b2f3da84cc8494d07cf0babc472c426ccb1c4ae13398243360c9d02c

SHA512
899d1e1b0feece25ac97527daddcaaeb069cb428532477849eba43a627502c590261f2c26fef31e4e20efd3d7eb0815336a784c4d2888e05afcf5477af872b06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e9a2c784e6d797d91d4b8612e14d51bd

SHA1
25e2b07c396ee82e4404af09424f747fc05f04c2

SHA256
18ddbb93c981d8006071f9d26924ce3357cad212cbb65f48812d4a474c197ce6

SHA512
fc35688ae3cd448ed6b2069d39ce1219612c54f5bb0dd7b707c9e6f39450fe9fb1338cf5bd0b82a45207fac2fbab1e0eae77e5c9e6488371390eab45f76a5df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
74446c3a02a3043a4e2bf4233fc735ec

SHA1
fddba3a43fd36aa8339510a2720fd6431cdb6520

SHA256
a26910d6f843f2daeab146a5ab1b39f1788b513d40c8c9dab2eace13967ed001

SHA512
69f3b2a5091ac2ca3d01c4edb186626954711089da80a3d6f6a1676339f93e998cd879585dc77e46cbdd56f52618d1d0449175eb10b061d33c2cf731e050cad7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d71437970f3ea0680cf66ab52458ac7e

SHA1
6694939665852bdedaca0d29ee84aa35a0187011

SHA256
bc78855d163b97f3b5925b8ff3d6da67f09ee979562033640cfad6a11146560c

SHA512
bee80b5c82d66ade1330fad70b1db211775a30c332c70e15a688c0d4426fc83215bd59f52281046b9fe1585c6711b43032f5b6667cbcb7e7b7ba4d1177268857

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
66e25debbeaffcbf38c7c8b1cd2605a2

SHA1
3058da3c58bed9f25569af2f757e23c158fac98b

SHA256
7c6e3c0d0a83538daa697011300b447ad385f3d04d302d4298f8e53a6cf4f791

SHA512
5585243cef194bf5a24b7a02b2e945996c233e03e13d20c8338a452ef6ded2879d862403793f456963ca282ac6ec8fe78dbc34ee97035195c6f5dc68caa37052

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\127990e6-bb14-4f86-91c2-a45652386fc7.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
memory/4484-3-0x00007FFDC8C30000-0x00007FFDC96F2000-memory.dmp

Filesize
10.8MB

Download
memory/4484-6-0x00007FFDC8C30000-0x00007FFDC96F2000-memory.dmp

Filesize
10.8MB

Download
memory/4484-5-0x00007FFDC8C33000-0x00007FFDC8C35000-memory.dmp

Filesize
8KB

Download
memory/4484-4-0x00000197B9630000-0x00000197B9B58000-memory.dmp

Filesize
5.2MB

Download
memory/4484-0-0x00007FFDC8C33000-0x00007FFDC8C35000-memory.dmp

Filesize
8KB

Download
memory/4484-2-0x00000197B83B0000-0x00000197B8572000-memory.dmp

Filesize
1.8MB

Download
memory/4484-1-0x000001979DC30000-0x000001979DC48000-memory.dmp

Filesize
96KB

Download