Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20250207-en -
resource tags
arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system -
submitted
12-02-2025 20:04
Behavioral task
behavioral1
Sample
Client-built.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Client-built.exe
Resource
win10v2004-20250207-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
Client-built.exe
-
Size
78KB
-
MD5
4fd26993b79ef2139a15e7eb49e3d13d
-
SHA1
aaf2f236c20b7231ef675bee1d4001dba217dc1b
-
SHA256
4c9ea2510db5a128cc9eb6e589ef82a026f4c319c38843ac42644c14732d5c28
-
SHA512
497fdf01f94bbd033c6c27d73b994fb12f24a5c0b767736355569ae216b123e4fa2123e8389940e3495d8f2bcc2510f6ec62e756559905a238ba6b3a8d34255a
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+xPIC:5Zv5PDwbjNrmAE+hIC
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTMzOTMyNDk1NDU0MTU1NTgxNA.Gs8FBT.MiEvMyM9NS2w2NGkXFjjCHXwHSMlStvjlqOb-Q
-
server_id
1339324858856636447
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Downloads MZ/PE file 1 IoCs
flow pid Process 45 316 Process not Found -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 944 MicrosoftEdgeUpdate.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3792 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4996 Client-built.exe Token: SeDebugPrivilege 3792 taskmgr.exe Token: SeSystemProfilePrivilege 3792 taskmgr.exe Token: SeCreateGlobalPrivilege 3792 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe 3792 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client-built.exe"C:\Users\Admin\AppData\Local\Temp\Client-built.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4996
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3792
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QkYzNDM0NDEtRDg4Mi00RTVELThGNEItRUQ1MEZDMTFFMzVCfSIgdXNlcmlkPSJ7NDBDMjVGMEQtREQ5Ni00OTkwLTkwN0QtMjY1NUFCQTIxNTkzfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RDY5RDlBMEUtNTZFQS00NDgxLTk1OEYtMUNFRkI5NEU0QTExfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI1IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDcxNzgiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxOTY4MDM3MTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MzU0MTgxMTU1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:944