Analysis
-
max time kernel
41s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
05-01-2025 06:08
Behavioral task
behavioral1
Sample
Discord rat.exe
Resource
win7-20241023-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
Discord rat.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
Discord rat.exe
-
Size
79KB
-
MD5
d13905e018eb965ded2e28ba0ab257b5
-
SHA1
6d7fe69566fddc69b33d698591c9a2c70d834858
-
SHA256
2bd631c6665656673a923c13359b0dc211debc05b2885127e26b0dce808e2dec
-
SHA512
b95bfdebef33ac72b6c21cdf0abb4961222b7efd17267cd7236e731dd0b6105ece28e784a95455f1ffc8a6dd1d580a467b07b3bd8cb2fb19e2111f1a864c97cb
-
SSDEEP
1536:YCH0jBD2BKkwbPNrfxCXhRoKV6+V+y9viwp:VUjBD2BPwbPNrmAE+MqU
Score
10/10
Malware Config
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies registry class 48 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 200000001a00eebbfe230000100090e24d373f126545916439c4925e467b00000000 chrome.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 chrome.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_Classes\Local Settings chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 chrome.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3} chrome.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "2" chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg chrome.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" chrome.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 chrome.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 chrome.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1" chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193" chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff chrome.exe Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 chrome.exe Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616193" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2588 chrome.exe 2588 chrome.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1652 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe Token: SeShutdownPrivilege 2588 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe 2588 chrome.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1652 chrome.exe 1652 chrome.exe 1652 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2064 wrote to memory of 3044 2064 Discord rat.exe 30 PID 2064 wrote to memory of 3044 2064 Discord rat.exe 30 PID 2064 wrote to memory of 3044 2064 Discord rat.exe 30 PID 2588 wrote to memory of 2392 2588 chrome.exe 33 PID 2588 wrote to memory of 2392 2588 chrome.exe 33 PID 2588 wrote to memory of 2392 2588 chrome.exe 33 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2168 2588 chrome.exe 35 PID 2588 wrote to memory of 2804 2588 chrome.exe 36 PID 2588 wrote to memory of 2804 2588 chrome.exe 36 PID 2588 wrote to memory of 2804 2588 chrome.exe 36 PID 2588 wrote to memory of 2928 2588 chrome.exe 37 PID 2588 wrote to memory of 2928 2588 chrome.exe 37 PID 2588 wrote to memory of 2928 2588 chrome.exe 37 PID 2588 wrote to memory of 2928 2588 chrome.exe 37 PID 2588 wrote to memory of 2928 2588 chrome.exe 37 PID 2588 wrote to memory of 2928 2588 chrome.exe 37 PID 2588 wrote to memory of 2928 2588 chrome.exe 37 PID 2588 wrote to memory of 2928 2588 chrome.exe 37 PID 2588 wrote to memory of 2928 2588 chrome.exe 37 PID 2588 wrote to memory of 2928 2588 chrome.exe 37 PID 2588 wrote to memory of 2928 2588 chrome.exe 37 PID 2588 wrote to memory of 2928 2588 chrome.exe 37 PID 2588 wrote to memory of 2928 2588 chrome.exe 37 PID 2588 wrote to memory of 2928 2588 chrome.exe 37 PID 2588 wrote to memory of 2928 2588 chrome.exe 37 PID 2588 wrote to memory of 2928 2588 chrome.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\Discord rat.exe"C:\Users\Admin\AppData\Local\Temp\Discord rat.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2064 -s 6002⤵PID:3044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7319758,0x7fef7319768,0x7fef73197782⤵PID:2392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1168 --field-trial-handle=1364,i,18158381366241828513,4883685498792003667,131072 /prefetch:22⤵PID:2168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1484 --field-trial-handle=1364,i,18158381366241828513,4883685498792003667,131072 /prefetch:82⤵PID:2804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1592 --field-trial-handle=1364,i,18158381366241828513,4883685498792003667,131072 /prefetch:82⤵PID:2928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2328 --field-trial-handle=1364,i,18158381366241828513,4883685498792003667,131072 /prefetch:12⤵PID:2436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2336 --field-trial-handle=1364,i,18158381366241828513,4883685498792003667,131072 /prefetch:12⤵PID:2028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1536 --field-trial-handle=1364,i,18158381366241828513,4883685498792003667,131072 /prefetch:22⤵PID:2124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1244 --field-trial-handle=1364,i,18158381366241828513,4883685498792003667,131072 /prefetch:12⤵PID:704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3672 --field-trial-handle=1364,i,18158381366241828513,4883685498792003667,131072 /prefetch:82⤵PID:688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3844 --field-trial-handle=1364,i,18158381366241828513,4883685498792003667,131072 /prefetch:12⤵PID:1796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=1364,i,18158381366241828513,4883685498792003667,131072 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1652
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1504
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5deebb40d2b5484d62910bc33ecd50663
SHA19f4f259cca6b636cd06135d2f84dd4d2fe8b5d14
SHA256498d52e66e9a714707f96521cf65f6550c0b7857e9f3301d4e6c3d898c63e87f
SHA512f175568e8ec72d011d6f123e0de699ae6d1e9a1de49acf72357a930e1f504592e2db6c3f3fa04b39175437db86391955eb322aad63de79e9a993c6a79ae8b602
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3ae80efe138a6975636e16111cb843c
SHA179136c93e5eaf6e4e5c0a8c6f34834bc86ad8176
SHA25671f4e0d8d0b68cbf842cf767792703c57846e53c2c0b3fcb695d47c5b21c57c6
SHA512554e9df2ef93fa4744be635b678a1130cabb808934419ec9f42cb34b23b2849969dd5e4c2cc05f32f24224f99f35a49b60411c5cdaa7e901c266eb02d7ab4357
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD512714a7761780d3c01ec5871634ffd02
SHA1acd9ff981053e14c569b0e0f72fac26a3d9e57ff
SHA2565dbf7020696fbd8ad4af4330a78841d492b0aa166c29b922939c8c1cb7665e92
SHA512a4797bb3c855ecb11c9cbb282907333dfa4d22e88d3c090c82f7628ebb5f06e3370bf095751172b65e6e5b71f72e7306081ae253808f0eec5c2fc743a27ee947
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ad0679732069cafb7f4fe9c6331c7bfa
SHA15a3cdf9b8825bd4e6513b225fd97791e8199db37
SHA256d53169de01b897d8398df532723ebc7bac27bd124646935035baf7fc0a8c273b
SHA5121827788bb346bb4be6dcdf14e14ed653b3aa8072962459a30d38ca349b8e1bfa906c0e42dde8e5330efb65d0b63f27d5b3a9a7d9681bed88caa7569eac0a9ad7
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
1KB
MD55380bc48d13bfdf7b0eb129c5343de93
SHA11bde1b060fdd6b26b039698a667d9225d18bd137
SHA2565c4ba7b4c9a7dbf8acd5ce9fa41c31639563fc27923276986484e732fa9f6e5e
SHA512742a603c967d135fb907a6c58069802dceddeb2eea25d74a7820b824fe8ccf05f79ba8713c963b51d74c41c170d5f6142bd0520d4d3b0feec47cb5b473fab083
-
Filesize
854B
MD5377fd6a01c62658edc1d67a893e50950
SHA1a67f94b622c86997ef8a7b40ca0873eee36095ce
SHA2566b03f50ec373a3a28498eee2cf380423bb480be3425e1400577f230fb9bcbca5
SHA51223b84ab1c4b3040296e717b07db3e9771b85ad2932a415856ed84f608e561046a490e432ce143ab31eeea8f59e2da6b39a108e1c2b668ae576d0130231418af6
-
Filesize
6KB
MD5fbab60dde3c6cfde68de9fdcc9e0d7d0
SHA159c46a01a422d62e6bab3bdf6e978dee5e51ea3b
SHA256c94d6f9d29ccaf0298de79393ecd5d0e45b152d855377b695e5954f5f96fbf33
SHA5122034c9c2353a9cf6d584ae06b4936cda14dbee507ef41f308c079ade8d083c8d82097cfb295e2d3f9bff1c8897a5c9ea09a0e1832679a8f5f3cded71e53e9fc4
-
Filesize
5KB
MD55962b7c87e5c8ed854b2a1a419695e75
SHA1d85c984c276db45d9139116c925786696e6c3fb5
SHA256f908c1d5f9e29f0a51edeb1f1ec5a0db50a8b656cee22bf9c474d91dfba735bf
SHA512b2d738345bd7bbd6b89ae8d7e654feef55c0fa39461bc38284590ee1147d2733835ce93200ee70cb34aff24f4007814e72358623bc274d5799be92cea517a297
-
Filesize
5KB
MD5de6d12b88ea47999e60ecf3826835b50
SHA1b126c3842f75d2af94b655a9959268fa69d32177
SHA25638d3897a56d8310c96afe1062e7e4d9b9c8afc44b9b95c10934da339cae349fd
SHA512880035ddc7dc3b3a208d30ac3a1d2785f90c0d335715591d2df60960f2a94ecd2753d240d306df2505bc0a2d2b5f2397fbbb3471998a0041f0e129695c33a97e
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
Filesize16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b