discordrat | hxxps://gofile[.]io/d/NstqMF

Analysis

max time kernel
421s
max time network
434s
platform
windows11-21h2_x64
resource
win11-20250217-de
resource tags

arch:x64arch:x86image:win11-20250217-delocale:de-deos:windows11-21h2-x64systemwindows
submitted
26/02/2025, 19:38

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://gofile.io/d/NstqMF

Score

10^/10

discordrat defense_evasion discovery persistence rat rootkit spyware stealer

Malware Config

Extracted

Family

discordrat

Attributes

discord_token
MTMzNjcxNTY5NDkzNDMyNzMxNg.Gu2Bf0.El1NdxHz24tFHg8PBy15fPdQ63zK211zkn3uLY
server_id
1336714876982136852

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Downloads MZ/PE file 1 IoCs

flow	pid	Process
27	1184	msedge.exe

Executes dropped EXE 33 IoCs

pid	Process
5028	loader.exe
2812	loader.exe
844	loader.exe
488	loader.exe
2748	loader.exe
2696	loader.exe
1436	loader.exe
4976	loader.exe
2652	loader.exe
4568	loader.exe
4028	loader.exe
900	loader.exe
1952	loader.exe
3508	loader.exe
5364	loader.exe
5676	loader.exe
4496	loader.exe
6088	loader.exe
5160	loader.exe
2960	loader.exe
5180	loader.exe
2980	loader.exe
1492	loader.exe
2704	loader.exe
1684	loader.exe
4780	loader.exe
2408	loader.exe
5512	loader.exe
5232	loader.exe
5292	loader.exe
1108	loader.exe
6464	loader.exe
6932	loader.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs

Web Service

T1102

flow	ioc
73	discord.com
102	discord.com
113	discord.com
35	discord.com
90	discord.com
111	discord.com
127	discord.com
146	discord.com
151	discord.com
179	discord.com
30	discord.com
64	raw.githubusercontent.com
80	discord.com
92	discord.com
125	discord.com
145	discord.com
169	discord.com
37	discord.com
66	discord.com
86	discord.com
136	discord.com
157	discord.com
164	discord.com
186	discord.com
200	discord.com
49	discord.com
68	discord.com
96	discord.com
110	discord.com
115	discord.com
122	discord.com
126	discord.com
158	discord.com
84	discord.com
162	discord.com
168	discord.com
178	discord.com
194	discord.com
210	discord.com
140	discord.com
123	discord.com
12	discord.com
43	discord.com
56	discord.com
59	discord.com
61	discord.com
63	discord.com
121	raw.githubusercontent.com
78	discord.com
100	discord.com
120	discord.com
130	discord.com
138	discord.com
141	discord.com
160	discord.com
173	discord.com
82	discord.com
94	discord.com
134	discord.com
176	discord.com
184	discord.com
201	discord.com
54	discord.com
85	discord.com

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\loader.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-112184765-1670301065-1210615588-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-112184765-1670301065-1210615588-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-112184765-1670301065-1210615588-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-112184765-1670301065-1210615588-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Nicht bestätigt 871405.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\loader.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1184	msedge.exe
1184	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
1828	msedge.exe
1828	msedge.exe
4376	msedge.exe
4376	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeDebugPrivilege	5028	loader.exe
Token: SeDebugPrivilege	2812	loader.exe
Token: SeDebugPrivilege	844	loader.exe
Token: SeDebugPrivilege	488	loader.exe
Token: SeDebugPrivilege	2748	loader.exe
Token: SeDebugPrivilege	2696	loader.exe
Token: SeDebugPrivilege	1436	loader.exe
Token: SeDebugPrivilege	4976	loader.exe
Token: SeDebugPrivilege	2652	loader.exe
Token: SeDebugPrivilege	4568	loader.exe
Token: SeDebugPrivilege	4028	loader.exe
Token: SeDebugPrivilege	900	loader.exe
Token: SeDebugPrivilege	1952	loader.exe
Token: SeDebugPrivilege	3508	loader.exe
Token: SeDebugPrivilege	5364	loader.exe
Token: SeDebugPrivilege	5676	loader.exe
Token: SeDebugPrivilege	4496	loader.exe
Token: SeDebugPrivilege	6088	loader.exe
Token: SeDebugPrivilege	5160	loader.exe
Token: SeDebugPrivilege	2960	loader.exe
Token: SeDebugPrivilege	5180	loader.exe
Token: SeDebugPrivilege	2980	loader.exe
Token: SeDebugPrivilege	1492	loader.exe
Token: SeDebugPrivilege	2704	loader.exe
Token: SeDebugPrivilege	1684	loader.exe
Token: SeDebugPrivilege	4780	loader.exe
Token: SeDebugPrivilege	2408	loader.exe
Token: SeDebugPrivilege	5512	loader.exe
Token: SeDebugPrivilege	5232	loader.exe
Token: SeDebugPrivilege	5292	loader.exe
Token: SeDebugPrivilege	1108	loader.exe
Token: SeDebugPrivilege	6464	loader.exe
Token: SeDebugPrivilege	6932	loader.exe
Token: SeShutdownPrivilege	6464	loader.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe
4628	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 2568	4628	msedge.exe	80
PID 4628 wrote to memory of 2568	4628	msedge.exe	80
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 5084	4628	msedge.exe	81
PID 4628 wrote to memory of 1184	4628	msedge.exe	82
PID 4628 wrote to memory of 1184	4628	msedge.exe	82
PID 4628 wrote to memory of 3084	4628	msedge.exe	83
PID 4628 wrote to memory of 3084	4628	msedge.exe	83
PID 4628 wrote to memory of 3084	4628	msedge.exe	83
PID 4628 wrote to memory of 3084	4628	msedge.exe	83
PID 4628 wrote to memory of 3084	4628	msedge.exe	83
PID 4628 wrote to memory of 3084	4628	msedge.exe	83
PID 4628 wrote to memory of 3084	4628	msedge.exe	83
PID 4628 wrote to memory of 3084	4628	msedge.exe	83
PID 4628 wrote to memory of 3084	4628	msedge.exe	83
PID 4628 wrote to memory of 3084	4628	msedge.exe	83
PID 4628 wrote to memory of 3084	4628	msedge.exe	83
PID 4628 wrote to memory of 3084	4628	msedge.exe	83
PID 4628 wrote to memory of 3084	4628	msedge.exe	83
PID 4628 wrote to memory of 3084	4628	msedge.exe	83
PID 4628 wrote to memory of 3084	4628	msedge.exe	83
PID 4628 wrote to memory of 3084	4628	msedge.exe	83
PID 4628 wrote to memory of 3084	4628	msedge.exe	83
PID 4628 wrote to memory of 3084	4628	msedge.exe	83
PID 4628 wrote to memory of 3084	4628	msedge.exe	83
PID 4628 wrote to memory of 3084	4628	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/NstqMF
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffaf0343cb8,0x7ffaf0343cc8,0x7ffaf0343cd8
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,2439626061693860243,4479766829385842860,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1944,2439626061693860243,4479766829385842860,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1944,2439626061693860243,4479766829385842860,131072 --lang=de --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,2439626061693860243,4479766829385842860,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,2439626061693860243,4479766829385842860,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,2439626061693860243,4479766829385842860,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,2439626061693860243,4479766829385842860,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,2439626061693860243,4479766829385842860,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1944,2439626061693860243,4479766829385842860,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1944,2439626061693860243,4479766829385842860,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1944,2439626061693860243,4479766829385842860,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,2439626061693860243,4479766829385842860,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,2439626061693860243,4479766829385842860,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,2439626061693860243,4479766829385842860,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,2439626061693860243,4479766829385842860,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1944,2439626061693860243,4479766829385842860,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=4684 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1944,2439626061693860243,4479766829385842860,131072 --lang=de --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:4496
- C:\Users\Admin\Downloads\loader.exe
  "C:\Users\Admin\Downloads\loader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,2439626061693860243,4479766829385842860,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4596 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3644

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1636

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2812

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:844

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:488

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2748

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2696

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1436

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4976

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2652

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4568

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4028

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:900

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1952

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3508

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5364

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5676

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4496

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6088

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5160

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:1652

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2960

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5180

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2980

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1492

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2704

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1684

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4780

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2408

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5512

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5232

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5292

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1108

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6464

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
825fb95a70bf7b56cfcda1f118800f98

SHA1
15f1e212c1fb567c70ff4f716a4bba81f2857e0a

SHA256
2280c42f8ca4302a1d37d63532e3e981e33b596e3b2e930ce40b390dc0f09104

SHA512
987189b84f58e5d64b662f80f47ae797bcf46aeba86584cc17afabd2f25885a4cf48d80400154ba22eeee1131b84f882cd1998d1686ee12013218f52049bc6d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e45a14e89fdf82756edc65c97e606e63

SHA1
42ce594393a4ce3b4e1c79dbe424841bd3f434c8

SHA256
49af9d716c69fb93ebee18e708f4ceaab99abf505abcbad1bd46c60ace03da9f

SHA512
6af0cabb253026d7613065e7274f8be114fc2cbd0134e8d518a417bf4b2b94ffc8b9c05be4e47685ac6d7246e28c11a86852ee4b6e934bf6c6d56b6c97428425

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
144B

MD5
1a8a47f1127eed940c265f926b02e843

SHA1
e3d245a0356d530d289ef3c38e7ed7ddd1a15205

SHA256
b9f9239ee573039ebeb4cbc2e85f92126fa35c20afbe85af60ef3241d2487b73

SHA512
721700ff59a7429ca0b658ce5e73412470fa2767973b14618cd666c25b49f5993ae2917a5544dc69270473f28400071fcd15335533b10f4c6d107275cd3a29c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
399B

MD5
25825d90d1b9ee75a7d57fe258d4e9ac

SHA1
049c359c016e3973f9656acfb730afc97b2c8a47

SHA256
abe59438ea9efc3795399242a90ad5d35b030080e1e0e5fa99cf0ea975608483

SHA512
7c60456d8960d18cfe0a3e35d9b8a2cf5a7ae6a15081362fc81eef4251cb75240f4496216d9458d07fffbdb4158e939da7a0c6954dc17230a70d496f2e3507d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5e3e0048f620d4f1922613f036352dab

SHA1
194c5db227a3ddc6bd32ee0a301dacf8f7ae2718

SHA256
330701f7fb04052d61c6866c0c5abf7276bc4f7d554890452dd20a97a6078ccf

SHA512
de29183419162aa81ad3d58402a98ea4c0f06f3cbb24b3514b428fcb8b0d280aaba2716cc3c7fe976e372fbb313169a5438afd930a89b7bd4f21d7912f5fb7e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
758c5e22cc23cae1796276312774e824

SHA1
c0ba240d7d9b3fef3281fa8c8c01848e22d2fa14

SHA256
68cfb27e8a8a9136f9b602c56716a503c2de104ac3b975c46462c97299f3f544

SHA512
a38579495f18d5eb1fb0976847e19363dee493d9b5e9affadb5ce346e2de2e8b83efcc308b21d5a0080edd78627cf7760675ebef09861c539cbb321a4357b670

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a01a7fe8745081c5387e3f790823a27c

SHA1
d21d9ce6018e665d034e7a2b65b7fa996f57076f

SHA256
941f00f4e21d96e2747c04f6680a54ab75b7334f15325d5d61b0fef491293a8d

SHA512
f0008a69e4657266809f7129765ec8439e31a99c5347358538e1f8b9d03daebefa7ff573110b7a6e9bb564534442ca0845064e6d728ee97faa860bc286bda6c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4e0b9b31647d3e554d7d4356d80cc68b

SHA1
ccfd337619e3ddc7958c7481856b4c9f419de914

SHA256
8f7bd614af8c7dbb1a18635b69d3013dd2a8ed982769ac206d75878b78da08e1

SHA512
6f43c529b6b5858efdc7045c983a858509b30e1e529ae5a2240d6e18782fe22a2ae750a8ecf58006684234ed0453ab3dba236e5b361a232636f364dd92633ba7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
405005045e8e423e97b49abc91b4ccbb

SHA1
bb6c2aa2272437f1943190b59e2c56d2d84f257c

SHA256
6924f5127f20c86c1f4d3d5e6ee1535b33dab6d7925fbe7e2f55af4270f5eac2

SHA512
571b75c180d8e8a2576c5ad0261d2897dbdabeaf54c01f4d53373cad608019a7b39b4092f1cfcc411592863455b18b9e77d7636db05f25ded239c7bfa2a24440

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
45c5c160f295083a6525ca2bfb99a8ab

SHA1
33c152ce85ed23e8a3a76c5a1f733f1078f93aeb

SHA256
44b67ba4061da95542d506364fca49fefe1948cf394204264c60e8b1b4b9ae77

SHA512
24cdf17f7d2811d87e3df4fdb731b5e21b5cc0090c6d231d6a785c5043efd0fa0d0b8788150acea718cc519f340c323ce22272989db10ba59e1fe07d758ba020

Download Submit
C:\Users\Admin\Downloads\Nicht bestätigt 871405.crdownload

Filesize
78KB

MD5
e07288f37d86d4c10fa112574cf9db0e

SHA1
5a9cdd5b8a3e9efa48e2c39d7eadda5e19674250

SHA256
9c7729a65e914bea20a4ace8ab8a023f33b580b748ad960f42ca1aebb8772aa7

SHA512
b29ef607d9ae035434d60bdaab676faf7770a2f9809f2842b3c42e7602faf6ba91b5fdede7d3db971a2158096e6a9045cf7a6dfd0b5f8770d1c6837281a1620f

Download Submit
C:\Users\Admin\Downloads\loader.exe:Zone.Identifier

Filesize
161B

MD5
45920d81b0fc45b7ef1d574c8963e22c

SHA1
d8cec544a9c6cba58692c3ece1dc9d2e51984d07

SHA256
cdb86879b5f80e932791892600870d13a29dd591bbb9e0c591ddea279155ee00

SHA512
9777ab71d63f97f356fbc02a4400f05f4e2c3616030f4d4547a40dc64b43bceea18a14fc116cdf2187104f4ae5216ecc12fcd7eed49d2e1a76a29776185c418f

Download Submit
memory/844-197-0x00000222D2D50000-0x00000222D2D6E000-memory.dmp

Filesize
120KB

Download
memory/844-196-0x00000222D2D20000-0x00000222D2D32000-memory.dmp

Filesize
72KB

Download
memory/844-195-0x00000222EBA80000-0x00000222EBAF6000-memory.dmp

Filesize
472KB

Download
memory/3508-217-0x0000024D707A0000-0x0000024D707AE000-memory.dmp

Filesize
56KB

Download
memory/5028-110-0x0000022A6EB10000-0x0000022A6EB28000-memory.dmp

Filesize
96KB

Download
memory/5028-125-0x0000022A716D0000-0x0000022A717D4000-memory.dmp

Filesize
1.0MB

Download
memory/5028-122-0x0000022A71C00000-0x0000022A72128000-memory.dmp

Filesize
5.2MB

Download
memory/5028-112-0x0000022A708E0000-0x0000022A70922000-memory.dmp

Filesize
264KB

Download
memory/5028-111-0x0000022A71320000-0x0000022A714E2000-memory.dmp

Filesize
1.8MB

Download