discordrat | 7c025b2421e49f55f97484db876940a4be40ad66180745bf5cbf27242aa5d433

Reason

Machine shutdown

General

Target

fortnite‮gpj.exe
Size

872KB
MD5

1e2050af9bccc9a8766a43fb83b9b1f0
SHA1

d26c33e6c6db918dccbd538877e301b28c90307e
SHA256

7c025b2421e49f55f97484db876940a4be40ad66180745bf5cbf27242aa5d433
SHA512

cf6c4085b0a260e920cb737c50cdce42fcf684120005072b6f4dd125ad058c142fc51220695d0b2ebc1e4c9e74283f5eb091b709a58e92ba8f0545bba4e116f6
SSDEEP

24576:X5ZWs+OZVEWry8AFBn+yHDB17T4ZQqKkFPJ1x1CwrNa6h8kQU17l:JZB1G8Yt+yjT/joFzxr46houl

Score

10^/10

discordrat persistence ransomware rat rootkit stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTE3MDQzNjc1NDU1NDI0NTE4MA.G8c-n6.n5Z1nJRp3yw5c3HWGqwGMY-vuXkB44mjt5C8jE
server_id
1298154591732629564

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	fortnite‮gpj.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	Client-built.exe

Executes dropped EXE 1 IoCs

pid	Process
1072	Client-built.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs

Web Service

T1102

flow	ioc
53	discord.com
55	discord.com
56	discord.com
17	discord.com
21	discord.com
50	discord.com
52	discord.com
18	discord.com
62	discord.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp3757.tmp.png"	Client-built.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "59"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1072	Client-built.exe
Token: SeShutdownPrivilege	4316	shutdown.exe
Token: SeRemoteShutdownPrivilege	4316	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1472	LogonUI.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 1072	1052	fortnite‮gpj.exe	84
PID 1052 wrote to memory of 1072	1052	fortnite‮gpj.exe	84
PID 1072 wrote to memory of 4316	1072	Client-built.exe	105
PID 1072 wrote to memory of 4316	1072	Client-built.exe	105

C:\Users\Admin\AppData\Local\Temp\fortnite‮gpj.exe
"C:\Users\Admin\AppData\Local\Temp\fortnite‮gpj.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\System32\shutdown.exe
    "C:\Windows\System32\shutdown.exe" /s /t 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4316

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38d0055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Client-built.exe

Filesize
78KB

MD5
31da0445e4df48447bf0837e5fd5d17d

SHA1
ef352de96cc41e40d2eff276102daf44297c0799

SHA256
9e43df1193f7077f7438de824501d1436ca1f126a307a6b7c81bc8d4a90efa2c

SHA512
a2b2271062f9fc9e98c5c1ef8ed8a4e53c2a4a3f2428df2b574ddcf0f3312f01610d2f5ae246a2d411212f79954e38028ccf13935f8f0d44e0a0ba336e8ea88f

Download Submit
memory/1072-16-0x00007FFFA1F23000-0x00007FFFA1F25000-memory.dmp

Filesize
8KB

Download
memory/1072-17-0x0000027349560000-0x0000027349578000-memory.dmp

Filesize
96KB

Download
memory/1072-18-0x0000027363B40000-0x0000027363D02000-memory.dmp

Filesize
1.8MB

Download
memory/1072-19-0x00007FFFA1F20000-0x00007FFFA29E1000-memory.dmp

Filesize
10.8MB

Download
memory/1072-20-0x0000027364440000-0x0000027364968000-memory.dmp

Filesize
5.2MB

Download
memory/1072-21-0x00007FFFA1F23000-0x00007FFFA1F25000-memory.dmp

Filesize
8KB

Download
memory/1072-22-0x00007FFFA1F20000-0x00007FFFA29E1000-memory.dmp

Filesize
10.8MB

Download
memory/1072-25-0x00007FFFA1F20000-0x00007FFFA29E1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

Errors