Analysis
-
max time kernel
62s -
max time network
63s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02-01-2025 19:09
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Client-built.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
cfd0aaeb9398c21d7909c7e0e4251e5d
-
SHA1
2b37850cc14cf0bf8f5b37d5af73497271541aa3
-
SHA256
c0ed5bfe17adceb9e9185071d02b801d96e3f392079e4900420aa2b78def1728
-
SHA512
3cd60b4547df54e37952dbd6a6a7bb68180cdd7fe42ccb3adeeade23b2c1ce64c7320dbd12cf18e30682fb507be0038c158e0e8c415aac54cd59b8bdf061e762
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V++PIC:5Zv5PDwbjNrmAE+6IC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTMyNDQ1MTcxNzcxODQ3NDc2Mg.GQa-G-.ZDxQ-KBMJu36zv0n9jlzDvCe1wNs6ml3C1LUw8
-
server_id
1324451611644268618
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3844 Client-built.exe Token: SeDebugPrivilege 4848 taskmgr.exe Token: SeSystemProfilePrivilege 4848 taskmgr.exe Token: SeCreateGlobalPrivilege 4848 taskmgr.exe Token: 33 4848 taskmgr.exe Token: SeIncBasePriorityPrivilege 4848 taskmgr.exe -
Suspicious use of FindShellTrayWindow 44 IoCs
pid Process 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe -
Suspicious use of SendNotifyMessage 44 IoCs
pid Process 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe 4848 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3844
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4848