Analysis
-
max time kernel
18s -
max time network
17s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
-
submitted
18-12-2024 16:33
General
-
Target
Moon/BootstraperRunmethenopenMoon.exe
-
Size
78KB
-
MD5
6849bba49988a6ec013e5f53b9cac85f
-
SHA1
4ed24456e470646a34854feb0f2b993211a8bc11
-
SHA256
d98a06bcad1ad76201650ec2e0a8dfe4e77e3f68f7b23687f9c62e571c440a80
-
SHA512
e2f129009a04e35f78afa2f5c23b336c7170dc2c5e0b79dd21e61a6e709a1293f518906a8177879b78935fef75ad597ac43a8dd7a5a7f44ce7526c5964e12468
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+jPIC:5Zv5PDwbjNrmAE+7IC
Malware Config
Extracted
discordrat
-
discord_token
MTI3MTEzMDc4MjAyMjM2OTMyNg.G5Ye-Q.rxyAh9UbKZ_ydFZicHmnl-aUZSkNccSaQl8Lv4
-
server_id
1265719817512685662
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 39 IoCs
-
Suspicious use of SendNotifyMessage 39 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Moon\BootstraperRunmethenopenMoon.exe"C:\Users\Admin\AppData\Local\Temp\Moon\BootstraperRunmethenopenMoon.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations=is-enterprise-managed=no --field-trial-handle=1328,i,418820165226066361,4591810059585231024,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:81⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
-
Filesize
8KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
5.2MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB