discordrat | c23bb4c0e5fa855bb65abd2d78866ab05889bcb2f7d57e059ca071091e699740

Analysis

max time kernel
823s
max time network
900s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
17-01-2025 20:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Pharaoh executor.exe
Size

78KB
MD5

ac602ff31d1129be588688ba9fb817c3
SHA1

7906b235c6ad4c72122198ec7b9be23dd42833a4
SHA256

c23bb4c0e5fa855bb65abd2d78866ab05889bcb2f7d57e059ca071091e699740
SHA512

e69ff869cbd51c67fa32d199ec671882648f16a641f8841631adf5b9ae4c496852aefae1387be5b12a616d52bf89d927a8a094187850b15f7278bbf0e5072168
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+9PIC:5Zv5PDwbjNrmAE+tIC

Score

10^/10

discordrat discovery persistence rat rootkit spyware stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMyNzQzMDAzNTM3NTY1Mjk0NA.Gona0D.U4USiJVqaeVQ1lTluE2D4rzs8gMjLpI7-b1Qws
server_id
1327344984113811487

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 19 IoCs

Web Service

T1102

flow	ioc
11	discord.com
12	discord.com
17	discord.com
19	discord.com
52	raw.githubusercontent.com
54	discord.com
5	discord.com
6	raw.githubusercontent.com
10	discord.com
14	raw.githubusercontent.com
55	discord.com
4	discord.com
9	discord.com
21	discord.com
18	raw.githubusercontent.com
20	discord.com
53	discord.com
8	discord.com
15	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1996	msedge.exe
1996	msedge.exe
4568	msedge.exe
4568	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2580	Pharaoh executor.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe
4568	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 4568	2580	Pharaoh executor.exe	77
PID 2580 wrote to memory of 4568	2580	Pharaoh executor.exe	77
PID 4568 wrote to memory of 5104	4568	msedge.exe	78
PID 4568 wrote to memory of 5104	4568	msedge.exe	78
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 3316	4568	msedge.exe	79
PID 4568 wrote to memory of 1996	4568	msedge.exe	80
PID 4568 wrote to memory of 1996	4568	msedge.exe	80
PID 4568 wrote to memory of 5060	4568	msedge.exe	81
PID 4568 wrote to memory of 5060	4568	msedge.exe	81
PID 4568 wrote to memory of 5060	4568	msedge.exe	81
PID 4568 wrote to memory of 5060	4568	msedge.exe	81
PID 4568 wrote to memory of 5060	4568	msedge.exe	81
PID 4568 wrote to memory of 5060	4568	msedge.exe	81
PID 4568 wrote to memory of 5060	4568	msedge.exe	81
PID 4568 wrote to memory of 5060	4568	msedge.exe	81
PID 4568 wrote to memory of 5060	4568	msedge.exe	81
PID 4568 wrote to memory of 5060	4568	msedge.exe	81
PID 4568 wrote to memory of 5060	4568	msedge.exe	81
PID 4568 wrote to memory of 5060	4568	msedge.exe	81
PID 4568 wrote to memory of 5060	4568	msedge.exe	81
PID 4568 wrote to memory of 5060	4568	msedge.exe	81
PID 4568 wrote to memory of 5060	4568	msedge.exe	81
PID 4568 wrote to memory of 5060	4568	msedge.exe	81
PID 4568 wrote to memory of 5060	4568	msedge.exe	81
PID 4568 wrote to memory of 5060	4568	msedge.exe	81

C:\Users\Admin\AppData\Local\Temp\Pharaoh executor.exe
"C:\Users\Admin\AppData\Local\Temp\Pharaoh executor.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.pornhub.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcdfcf3cb8,0x7ffcdfcf3cc8,0x7ffcdfcf3cd8
    3⤵
    PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,17295329517656227416,6042387983258862487,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
    3⤵
    PID:3316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,17295329517656227416,6042387983258862487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,17295329517656227416,6042387983258862487,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17295329517656227416,6042387983258862487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
    3⤵
    PID:484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17295329517656227416,6042387983258862487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
    3⤵
    PID:1184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17295329517656227416,6042387983258862487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
    3⤵
    PID:480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17295329517656227416,6042387983258862487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
    3⤵
    PID:5108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,17295329517656227416,6042387983258862487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
    3⤵
    PID:2136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,17295329517656227416,6042387983258862487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4804 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1fc959921446fa3ab5813f75ca4d0235

SHA1
0aeef3ba7ba2aa1f725fca09432d384b06995e2a

SHA256
1b1e89d3b2f3da84cc8494d07cf0babc472c426ccb1c4ae13398243360c9d02c

SHA512
899d1e1b0feece25ac97527daddcaaeb069cb428532477849eba43a627502c590261f2c26fef31e4e20efd3d7eb0815336a784c4d2888e05afcf5477af872b06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e9a2c784e6d797d91d4b8612e14d51bd

SHA1
25e2b07c396ee82e4404af09424f747fc05f04c2

SHA256
18ddbb93c981d8006071f9d26924ce3357cad212cbb65f48812d4a474c197ce6

SHA512
fc35688ae3cd448ed6b2069d39ce1219612c54f5bb0dd7b707c9e6f39450fe9fb1338cf5bd0b82a45207fac2fbab1e0eae77e5c9e6488371390eab45f76a5df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
5da1ce7ad90ee0ce9fe54bb6d55e2464

SHA1
c79ef72114b3b02f7f2db65bf0c2c3647c3f8ee0

SHA256
c3f0dd7e6108968fe63012e6d17adba89487e1f74171338b144c961b5f87a484

SHA512
70f4f40e4241b24e465dde24c1fc9b0441ecfa4dd7212bc976aaecfddbe727113bdb49227a221b3439e69e8af5648aa8555258fc229133699075284fc84c9ceb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
773B

MD5
db91d4eedf67746ec75a7d1fb56d033f

SHA1
02652f37bd3c7b077bdb39c278988badc727d776

SHA256
0c7c8e830759170eac65230f40f35d40f43f54a3116d91d69a25f1333e40bd0e

SHA512
0921590da8bb99341ff13826fa206befe105153cad376ec4e1383601ee27c79d7052d5ab531a0f9cd241095175847ac00d6ed9e0a5c133ab84127031022b6f4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ced90bca73f2040d99e3c50ee169da9b

SHA1
50723e2ddb4fd69630d8ef673d873e1241de0226

SHA256
1e58a5d72ec6720e0547aaa901a7efba567c0a747f5d63b8417c32d581c52e82

SHA512
e8ae0b7056001a614cffa40044a8f104cc4a7fa26e67db086279ff67c22ede2b12e77174f553138d6ab86e2be180e07e6c3798746e3f7ea27b3ab854d1f499be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
19467212772bdf73e8eee2d1d15a7820

SHA1
0145746f3af7c43d3d0f6ce980ef23eab9ebae6e

SHA256
4186ea26a872f9df2124e3ac9d275f1b564a8da1ff1529abf2e1cf7c6644702f

SHA512
a58aea3c2b3d94cae22f41c08001fcea731253d47da5b52db10760d27bbed319ecbc7d8e19271bd8bf73e00e41dc52d6a776aed2110c3ce2aef8aa8e5c853ddc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f21a95dfdbeec1e83b24cb9af552d64c

SHA1
1a03ad90d438c8acb265827f966c7078b8ce3047

SHA256
efbe76463862956162d2b27b9af6a62b56a05bcd99d1b4ba006dc2c0cd887c97

SHA512
60fc18d505784f6e8527163c8946722bb824ae57196d84fe39008ba9cec1611b0a8e7f2bb0dcfaf31f1007a75882cdcdeb372e4784a7d756cee88358d955c9c6

Download Submit
memory/2580-8-0x0000020AFD3B0000-0x0000020AFD67A000-memory.dmp

Filesize
2.8MB

Download
memory/2580-7-0x0000020AE3230000-0x0000020AE323E000-memory.dmp

Filesize
56KB

Download
memory/2580-0-0x00007FFCC53F3000-0x00007FFCC53F5000-memory.dmp

Filesize
8KB

Download
memory/2580-6-0x00007FFCC53F0000-0x00007FFCC5EB2000-memory.dmp

Filesize
10.8MB

Download
memory/2580-5-0x00007FFCC53F3000-0x00007FFCC53F5000-memory.dmp

Filesize
8KB

Download
memory/2580-4-0x0000020AFCE80000-0x0000020AFD3A8000-memory.dmp

Filesize
5.2MB

Download
memory/2580-3-0x00007FFCC53F0000-0x00007FFCC5EB2000-memory.dmp

Filesize
10.8MB

Download
memory/2580-2-0x0000020AFBC00000-0x0000020AFBDC2000-memory.dmp

Filesize
1.8MB

Download
memory/2580-1-0x0000020AE1530000-0x0000020AE1548000-memory.dmp

Filesize
96KB

Download
memory/2580-162-0x0000020AFCDB0000-0x0000020AFCE26000-memory.dmp

Filesize
472KB

Download
memory/2580-163-0x0000020AFBBF0000-0x0000020AFBC02000-memory.dmp

Filesize
72KB

Download
memory/2580-164-0x0000020AFCAE0000-0x0000020AFCAFE000-memory.dmp

Filesize
120KB

Download