Analysis
-
max time kernel
426s -
max time network
444s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 00:35
Behavioral task
behavioral1
Sample
New Client.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
900 seconds
General
-
Target
New Client.exe
-
Size
167KB
-
MD5
c05d3f2f9e97414951d9a850925aae47
-
SHA1
adf749dcdd4107fd1e9a4c235745e8dbd0c367c1
-
SHA256
7e7889837a4f42bbc91494f39f5439ce7fc714eed949fe0c2874524fbc8122d7
-
SHA512
04c753ee0f3155eee7db2280543e1b4309d154025ebdfddec9e5eb1943e2ef679aa4836d8c4105b81139c5ab0f8fd8d872eb2b00951998ec7b1e8dfcb4a0b212
-
SSDEEP
3072:VcMADoN36tnQviFCtABnKfWl9zqaF9bwYvMJUJ8T2SXZyrgoBJtbN/3MCK2kevEz:V9i9z/vM1/JdSI5eb
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation New Client.exe -
Executes dropped EXE 2 IoCs
pid Process 4912 discord.exe 4604 discord.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\discord.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\discord.exe\" .." discord.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\discord.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\discord.exe\" .." discord.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 51 IoCs
flow ioc 44 pastebin.com 60 pastebin.com 62 pastebin.com 64 pastebin.com 77 pastebin.com 94 pastebin.com 95 pastebin.com 56 pastebin.com 59 pastebin.com 68 pastebin.com 75 pastebin.com 85 pastebin.com 86 pastebin.com 88 pastebin.com 46 pastebin.com 58 pastebin.com 69 pastebin.com 71 pastebin.com 78 pastebin.com 93 pastebin.com 41 pastebin.com 51 pastebin.com 61 pastebin.com 83 pastebin.com 89 pastebin.com 63 pastebin.com 72 pastebin.com 74 pastebin.com 76 pastebin.com 79 pastebin.com 48 pastebin.com 57 pastebin.com 66 pastebin.com 73 pastebin.com 80 pastebin.com 21 pastebin.com 40 pastebin.com 45 pastebin.com 55 pastebin.com 65 pastebin.com 67 pastebin.com 70 pastebin.com 81 pastebin.com 82 pastebin.com 84 pastebin.com 90 pastebin.com 91 pastebin.com 92 pastebin.com 20 pastebin.com 47 pastebin.com 87 pastebin.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language discord.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language choice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language discord.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language New Client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Kills process with taskkill 14 IoCs
pid Process 1744 taskkill.exe 4448 taskkill.exe 2944 taskkill.exe 3908 taskkill.exe 2640 taskkill.exe 1900 taskkill.exe 3164 taskkill.exe 1620 taskkill.exe 4004 taskkill.exe 4428 taskkill.exe 1856 taskkill.exe 4772 taskkill.exe 3132 taskkill.exe 4504 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2084 taskmgr.exe Token: SeSystemProfilePrivilege 2084 taskmgr.exe Token: SeCreateGlobalPrivilege 2084 taskmgr.exe Token: SeDebugPrivilege 4912 discord.exe Token: 33 4912 discord.exe Token: SeIncBasePriorityPrivilege 4912 discord.exe Token: 33 4912 discord.exe Token: SeIncBasePriorityPrivilege 4912 discord.exe Token: 33 2084 taskmgr.exe Token: SeIncBasePriorityPrivilege 2084 taskmgr.exe Token: 33 4912 discord.exe Token: SeIncBasePriorityPrivilege 4912 discord.exe Token: 33 4912 discord.exe Token: SeIncBasePriorityPrivilege 4912 discord.exe Token: 33 4912 discord.exe Token: SeIncBasePriorityPrivilege 4912 discord.exe Token: 33 4912 discord.exe Token: SeIncBasePriorityPrivilege 4912 discord.exe Token: 33 4912 discord.exe Token: SeIncBasePriorityPrivilege 4912 discord.exe Token: 33 4912 discord.exe Token: SeIncBasePriorityPrivilege 4912 discord.exe Token: 33 4912 discord.exe Token: SeIncBasePriorityPrivilege 4912 discord.exe Token: 33 4912 discord.exe Token: SeIncBasePriorityPrivilege 4912 discord.exe Token: 33 4912 discord.exe Token: SeIncBasePriorityPrivilege 4912 discord.exe Token: 33 4912 discord.exe Token: SeIncBasePriorityPrivilege 4912 discord.exe Token: 33 4912 discord.exe Token: SeIncBasePriorityPrivilege 4912 discord.exe Token: 33 4912 discord.exe Token: SeIncBasePriorityPrivilege 4912 discord.exe Token: 33 4912 discord.exe Token: SeIncBasePriorityPrivilege 4912 discord.exe Token: 33 4912 discord.exe Token: SeIncBasePriorityPrivilege 4912 discord.exe Token: 33 4912 discord.exe Token: SeIncBasePriorityPrivilege 4912 discord.exe Token: 33 4912 discord.exe Token: SeIncBasePriorityPrivilege 4912 discord.exe Token: 33 4912 discord.exe Token: SeIncBasePriorityPrivilege 4912 discord.exe Token: 33 4912 discord.exe Token: SeIncBasePriorityPrivilege 4912 discord.exe Token: 33 4912 discord.exe Token: SeIncBasePriorityPrivilege 4912 discord.exe Token: 33 4912 discord.exe Token: SeIncBasePriorityPrivilege 4912 discord.exe Token: 33 4912 discord.exe Token: SeIncBasePriorityPrivilege 4912 discord.exe Token: 33 4912 discord.exe Token: SeIncBasePriorityPrivilege 4912 discord.exe Token: 33 4912 discord.exe Token: SeIncBasePriorityPrivilege 4912 discord.exe Token: 33 4912 discord.exe Token: SeIncBasePriorityPrivilege 4912 discord.exe Token: 33 4912 discord.exe Token: SeIncBasePriorityPrivilege 4912 discord.exe Token: 33 4912 discord.exe Token: SeIncBasePriorityPrivilege 4912 discord.exe Token: 33 4912 discord.exe Token: SeIncBasePriorityPrivilege 4912 discord.exe -
Suspicious use of FindShellTrayWindow 54 IoCs
pid Process 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe -
Suspicious use of SendNotifyMessage 54 IoCs
pid Process 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe 2084 taskmgr.exe -
Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 3036 wrote to memory of 4912 3036 New Client.exe 92 PID 3036 wrote to memory of 4912 3036 New Client.exe 92 PID 3036 wrote to memory of 4912 3036 New Client.exe 92 PID 3036 wrote to memory of 708 3036 New Client.exe 93 PID 3036 wrote to memory of 708 3036 New Client.exe 93 PID 3036 wrote to memory of 708 3036 New Client.exe 93 PID 708 wrote to memory of 1320 708 cmd.exe 95 PID 708 wrote to memory of 1320 708 cmd.exe 95 PID 708 wrote to memory of 1320 708 cmd.exe 95 PID 4912 wrote to memory of 1744 4912 discord.exe 105 PID 4912 wrote to memory of 1744 4912 discord.exe 105 PID 4912 wrote to memory of 1744 4912 discord.exe 105 PID 4912 wrote to memory of 1900 4912 discord.exe 107 PID 4912 wrote to memory of 1900 4912 discord.exe 107 PID 4912 wrote to memory of 1900 4912 discord.exe 107 PID 4912 wrote to memory of 1620 4912 discord.exe 109 PID 4912 wrote to memory of 1620 4912 discord.exe 109 PID 4912 wrote to memory of 1620 4912 discord.exe 109 PID 4912 wrote to memory of 4004 4912 discord.exe 111 PID 4912 wrote to memory of 4004 4912 discord.exe 111 PID 4912 wrote to memory of 4004 4912 discord.exe 111 PID 4912 wrote to memory of 4448 4912 discord.exe 116 PID 4912 wrote to memory of 4448 4912 discord.exe 116 PID 4912 wrote to memory of 4448 4912 discord.exe 116 PID 4912 wrote to memory of 4428 4912 discord.exe 118 PID 4912 wrote to memory of 4428 4912 discord.exe 118 PID 4912 wrote to memory of 4428 4912 discord.exe 118 PID 4912 wrote to memory of 4772 4912 discord.exe 121 PID 4912 wrote to memory of 4772 4912 discord.exe 121 PID 4912 wrote to memory of 4772 4912 discord.exe 121 PID 4912 wrote to memory of 2944 4912 discord.exe 124 PID 4912 wrote to memory of 2944 4912 discord.exe 124 PID 4912 wrote to memory of 2944 4912 discord.exe 124 PID 4912 wrote to memory of 1856 4912 discord.exe 127 PID 4912 wrote to memory of 1856 4912 discord.exe 127 PID 4912 wrote to memory of 1856 4912 discord.exe 127 PID 4912 wrote to memory of 3132 4912 discord.exe 129 PID 4912 wrote to memory of 3132 4912 discord.exe 129 PID 4912 wrote to memory of 3132 4912 discord.exe 129 PID 4912 wrote to memory of 3908 4912 discord.exe 131 PID 4912 wrote to memory of 3908 4912 discord.exe 131 PID 4912 wrote to memory of 3908 4912 discord.exe 131 PID 4912 wrote to memory of 2640 4912 discord.exe 133 PID 4912 wrote to memory of 2640 4912 discord.exe 133 PID 4912 wrote to memory of 2640 4912 discord.exe 133 PID 4912 wrote to memory of 4504 4912 discord.exe 135 PID 4912 wrote to memory of 4504 4912 discord.exe 135 PID 4912 wrote to memory of 4504 4912 discord.exe 135 PID 4912 wrote to memory of 3164 4912 discord.exe 137 PID 4912 wrote to memory of 3164 4912 discord.exe 137 PID 4912 wrote to memory of 3164 4912 discord.exe 137
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Client.exe"C:\Users\Admin\AppData\Local\Temp\New Client.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Roaming\discord.exe"C:\Users\Admin\AppData\Roaming\discord.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:1744
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:1900
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:1620
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:4004
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:4448
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:4428
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:4772
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:2944
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:1856
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:3132
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:3908
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:2640
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:4504
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:3164
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\New Client.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:708 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 53⤵
- System Location Discovery: System Language Discovery
PID:1320
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2084
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4368
-
C:\Users\Admin\AppData\Roaming\discord.exe"C:\Users\Admin\AppData\Roaming\discord.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4604
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
319B
MD5da4fafeffe21b7cb3a8c170ca7911976
SHA150ef77e2451ab60f93f4db88325b897d215be5ad
SHA2567341a4a13e81cbb5b7f39ec47bb45f84836b08b8d8e3ea231d2c7dad982094f7
SHA5120bc24b69460f31a0ebc0628b99908d818ee85feb7e4b663271d9375b30cced0cd55a0bbf8edff1281a4c886ddf4476ffc989c283069cdcb1235ffcb265580fc6
-
Filesize
167KB
MD5c05d3f2f9e97414951d9a850925aae47
SHA1adf749dcdd4107fd1e9a4c235745e8dbd0c367c1
SHA2567e7889837a4f42bbc91494f39f5439ce7fc714eed949fe0c2874524fbc8122d7
SHA51204c753ee0f3155eee7db2280543e1b4309d154025ebdfddec9e5eb1943e2ef679aa4836d8c4105b81139c5ab0f8fd8d872eb2b00951998ec7b1e8dfcb4a0b212