discordrat | 6320da463ff49f3b80eeb9b96a8bbfc71b430e4482b94d383fd3862490a5d13f

Analysis

max time kernel
48s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-12-2024 04:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AIMr.zip
Size

28KB
MD5

aae42972c1e1c843f3f71d35b0caa444
SHA1

58c2a05f22cc3439b66262ba8c19417eca4a59fa
SHA256

6320da463ff49f3b80eeb9b96a8bbfc71b430e4482b94d383fd3862490a5d13f
SHA512

4efdd7667c3f15ea072806e6788834e33df81989cf28bffb8400a0d4cd4b4f74e65aec709187154a974dbcac6ca1ee6b0d89bda51a47154215b9a06a86832321
SSDEEP

768:4JbueZxb6kkmJIK2FAgVZ1TDOGAWNloIvE:4LOne0D4GZzK

Score

10^/10

discordrat persistence rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
ODgxNzQzODc5NTAwNTk5MzM3.Gz4jXn.nabvUjO4zX_jYK_mdMBrfdMRfCB5q240mJH-vo
server_id
1310387822045171713

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Executes dropped EXE 3 IoCs

pid	Process
2368	AIMr.exe
2444	AIMr.exe
2312	AIMr.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3904	7zFM.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeRestorePrivilege	3904	7zFM.exe
Token: 35	3904	7zFM.exe
Token: SeSecurityPrivilege	3904	7zFM.exe
Token: SeDebugPrivilege	2368	AIMr.exe
Token: SeSecurityPrivilege	3904	7zFM.exe
Token: SeDebugPrivilege	2444	AIMr.exe
Token: SeSecurityPrivilege	3904	7zFM.exe
Token: SeDebugPrivilege	2312	AIMr.exe
Token: SeDebugPrivilege	4984	taskmgr.exe
Token: SeSystemProfilePrivilege	4984	taskmgr.exe
Token: SeCreateGlobalPrivilege	4984	taskmgr.exe
Token: 33	4984	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4984	taskmgr.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
3904	7zFM.exe
3904	7zFM.exe
3904	7zFM.exe
3904	7zFM.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe

Suspicious use of SendNotifyMessage 52 IoCs

pid	Process
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe
4984	taskmgr.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 2368	3904	7zFM.exe	91
PID 3904 wrote to memory of 2368	3904	7zFM.exe	91
PID 3904 wrote to memory of 2444	3904	7zFM.exe	102
PID 3904 wrote to memory of 2444	3904	7zFM.exe	102
PID 3904 wrote to memory of 2312	3904	7zFM.exe	104
PID 3904 wrote to memory of 2312	3904	7zFM.exe	104

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\AIMr.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Users\Admin\AppData\Local\Temp\7zO04F341B7\AIMr.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO04F341B7\AIMr.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2368
- C:\Users\Admin\AppData\Local\Temp\7zO04FA67D7\AIMr.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO04FA67D7\AIMr.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2444
- C:\Users\Admin\AppData\Local\Temp\7zO04F0DCE7\AIMr.exe
  "C:\Users\Admin\AppData\Local\Temp\7zO04F0DCE7\AIMr.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2312

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zO04F341B7\AIMr.exe

Filesize
78KB

MD5
67e0e6dc1dab2b50e036948470c1bf5f

SHA1
f77d90748617aa516d95f06a6ef4fa511d9739fe

SHA256
07c46b658c76254d83cccd35b28ee12f948ec01b1e24b12eefe4d93752ddb8a1

SHA512
76b30103fa0612c11044543d5be4e36ad0340a3f1cdf91955e01911e886b427302dfa56972d9c9e554df8fbd30ae22b48293bd52241215df36a82022aea6959a

Download Submit
memory/2368-12-0x00007FFFAD453000-0x00007FFFAD455000-memory.dmp

Filesize
8KB

Download
memory/2368-13-0x000002F5603A0000-0x000002F5603B8000-memory.dmp

Filesize
96KB

Download
memory/2368-14-0x000002F57A970000-0x000002F57AB32000-memory.dmp

Filesize
1.8MB

Download
memory/2368-15-0x00007FFFAD450000-0x00007FFFADF11000-memory.dmp

Filesize
10.8MB

Download
memory/2368-16-0x000002F57B170000-0x000002F57B698000-memory.dmp

Filesize
5.2MB

Download
memory/2368-41-0x00007FFFAD453000-0x00007FFFAD455000-memory.dmp

Filesize
8KB

Download
memory/2368-42-0x00007FFFAD450000-0x00007FFFADF11000-memory.dmp

Filesize
10.8MB

Download
memory/4984-45-0x000001C47CED0000-0x000001C47CED1000-memory.dmp

Filesize
4KB

Download
memory/4984-44-0x000001C47CED0000-0x000001C47CED1000-memory.dmp

Filesize
4KB

Download
memory/4984-43-0x000001C47CED0000-0x000001C47CED1000-memory.dmp

Filesize
4KB

Download
memory/4984-55-0x000001C47CED0000-0x000001C47CED1000-memory.dmp

Filesize
4KB

Download
memory/4984-54-0x000001C47CED0000-0x000001C47CED1000-memory.dmp

Filesize
4KB

Download
memory/4984-53-0x000001C47CED0000-0x000001C47CED1000-memory.dmp

Filesize
4KB

Download
memory/4984-52-0x000001C47CED0000-0x000001C47CED1000-memory.dmp

Filesize
4KB

Download
memory/4984-51-0x000001C47CED0000-0x000001C47CED1000-memory.dmp

Filesize
4KB

Download
memory/4984-50-0x000001C47CED0000-0x000001C47CED1000-memory.dmp

Filesize
4KB

Download
memory/4984-49-0x000001C47CED0000-0x000001C47CED1000-memory.dmp

Filesize
4KB

Download