discordrat | hxxps://github[.]com/moom825/Discord-RAT-2[.]0/releases/tag/2[.]0

Analysis

max time kernel
62s
max time network
63s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250410-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250410-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
15/04/2025, 07:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/moom825/Discord-RAT-2.0/releases/tag/2.0

Score

10^/10

discordrat discovery persistence rat rootkit stealer

Malware Config

Signatures

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat
Discordrat family
discordrat

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	builder.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133891743606890229"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3457531954-2054407110-1019940402-1000\{7873D5F7-2E83-47C4-8922-8D7D4A114D00}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3457531954-2054407110-1019940402-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3457531954-2054407110-1019940402-1000_Classes\Local Settings	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5364	Discord rat.exe
Token: SeDebugPrivilege	4556	taskmgr.exe
Token: SeSystemProfilePrivilege	4556	taskmgr.exe
Token: SeCreateGlobalPrivilege	4556	taskmgr.exe

Suspicious use of FindShellTrayWindow 56 IoCs

pid	Process
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe

Suspicious use of SendNotifyMessage 46 IoCs

pid	Process
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe
4556	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 3180	2808	msedge.exe	81
PID 2808 wrote to memory of 3180	2808	msedge.exe	81
PID 2808 wrote to memory of 6044	2808	msedge.exe	82
PID 2808 wrote to memory of 6044	2808	msedge.exe	82
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 5180	2808	msedge.exe	83
PID 2808 wrote to memory of 1864	2808	msedge.exe	84
PID 2808 wrote to memory of 1864	2808	msedge.exe	84
PID 2808 wrote to memory of 1864	2808	msedge.exe	84
PID 2808 wrote to memory of 1864	2808	msedge.exe	84
PID 2808 wrote to memory of 1864	2808	msedge.exe	84
PID 2808 wrote to memory of 1864	2808	msedge.exe	84
PID 2808 wrote to memory of 1864	2808	msedge.exe	84
PID 2808 wrote to memory of 1864	2808	msedge.exe	84
PID 2808 wrote to memory of 1864	2808	msedge.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/moom825/Discord-RAT-2.0/releases/tag/2.0
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ff98b6ff208,0x7ff98b6ff214,0x7ff98b6ff220
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1892,i,7209181412505244909,18180063989950729559,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2232,i,7209181412505244909,18180063989950729559,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2548,i,7209181412505244909,18180063989950729559,262144 --variations-seed-version --mojo-platform-channel-handle=1640 /prefetch:8
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3436,i,7209181412505244909,18180063989950729559,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3448,i,7209181412505244909,18180063989950729559,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5072,i,7209181412505244909,18180063989950729559,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5044,i,7209181412505244909,18180063989950729559,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5616,i,7209181412505244909,18180063989950729559,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5828,i,7209181412505244909,18180063989950729559,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5828,i,7209181412505244909,18180063989950729559,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6244,i,7209181412505244909,18180063989950729559,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=6308,i,7209181412505244909,18180063989950729559,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6276,i,7209181412505244909,18180063989950729559,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=5664,i,7209181412505244909,18180063989950729559,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6972,i,7209181412505244909,18180063989950729559,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6996,i,7209181412505244909,18180063989950729559,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6944,i,7209181412505244909,18180063989950729559,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6412,i,7209181412505244909,18180063989950729559,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:2480

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:5552

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2608

C:\Users\Admin\Downloads\release\Release\Discord rat.exe
"C:\Users\Admin\Downloads\release\Release\Discord rat.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5364

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4556

C:\Users\Admin\Downloads\release\builder.exe
"C:\Users\Admin\Downloads\release\builder.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
845d842365a2b1d6fc543d5987a8444c

SHA1
d9e74493c371fda8850da9a0daa8bc4f77ec0326

SHA256
6f55c946ac04a6258c714365d9a2cd4ac841e695f3be9f04e84310e5d9ab6110

SHA512
3fa48469bc4e7d480b7ad5c98a8a3e4e3f210ad986b6aa4e6d8b3a2a0061b2ad7423ac673fb45a435bbdd927f623e3032039b8fbf0aaf5a9ecd98831378562d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
d1824ad2f76361a75a961d3181a69f03

SHA1
e3363d2c81bce6ca9de41f10c528dd61a44b7594

SHA256
e762ff880b0ec9e2a6e234cf4acd7315a7fdd099afda2be028095a6f9867b233

SHA512
5fee0ca85031e50690d99b691906b546faa0d3eae4a3857c3a0b383d8a4d31ff0d45ff4dafcddc769dc40491c5cf9b45d70fad8864b381ac66e66913822b0de9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57de89.TMP

Filesize
3KB

MD5
3f0ff704783d568263f3a3d1e12f7e92

SHA1
c67240870c23f1f194728feac5fb8de4fd4b5f1e

SHA256
c331ce7017e3387ec1470850569d973810dbbb7b416b5da2f7640f7e7cb7f278

SHA512
5b8feae07fa38d717165993e28f1fd3c3e095deefec51804b59b5e8c3f80476f7a67fa2fd6b9aab2fd6237c9bd2728a5df3307b6cfd5663c887a308537ec516f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
2b66d93c82a06797cdfd9df96a09e74a

SHA1
5f7eb526ee8a0c519b5d86c845fea8afd15b0c28

SHA256
d4c064db769b3c109da2ed80a53fbab00987c17421a47921e41e213781d67954

SHA512
95e45c0aea0e704be5f512dffaae377d4abef78da99b3bca769264d69be20f2570daf2f47905645217e1b2696e42b101f26149219f148b4d6dd97a6c2868b6f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
16ac0e9f96f0f43f5ef050550588b54d

SHA1
b5eab8bdb8679e01209dcaa1a1d2bf6db7862ca5

SHA256
eef7b14b3cef12b5f2f598b0bebfa3053a32a8f41b6b8803edafa1c38e3f1fd7

SHA512
07393b8462740512b93fddf4ff187f48ab741e2b979b6b50254923f256f7c2f6005da19a437793554a7ac1af7438ead9b8e1fc87efab860cbb573f4ae0693c5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
8cf0bcff4fb442a40158b0f1f74d65a7

SHA1
f4b2768454e7bb5d0bd0abf690f7346f73824499

SHA256
e9aba5660e58e691bfea9155d5b0bd0b8db8074c6aacbd241c8d529df64f59bd

SHA512
3da7b4d6784f9b7fece0c8ef57e0d4063a6304584b73c4c7289314c5759f86ca43afe2ad65152ef4f525591399706857aa9b0b2f0c29e7867e0d1974e75319a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
f221d14fa2a302de425895fef5651d94

SHA1
c756c781c9b09a836e936200cda1e60bdb7f7d27

SHA256
d9cd9e5b1f44ab769a84703f1cf8fab41b5705e97bc50e3c72dcda2d7b0ff0b1

SHA512
04d65a9b21a91ed7d21f7375dae8bce2a22850b779bafc985ec3dd1fb5be08b6a7f030cef31ecf1c83e342578a309cca5e57f71fb7c83d3b3d55db8924828c19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
465B

MD5
5e4e6f2090c0cac47afcf5b3999d29e7

SHA1
e09aeb47c4967bbcf774c0449b079f4d044eea4b

SHA256
8a2dfa2a5a26e876898518a42854e32eab9c5165d2b02fb059397b87ee1a78e6

SHA512
36f7c33b503c8e8bb56fbda297dc6b246556727d1de95c45b52074e0d32c6e20ba7b2e82661b04e187f5faa32404c860ad2cab7399ef52a04ee357d723c2089f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
20KB

MD5
338e44d54f1caac73a4d8d75438af6e9

SHA1
dcb3bcc4b7e837f0a954ac141e7b766d495c2a88

SHA256
839b59d28e3fd144ba93e45b20bfdaa623d2e529c1e7e7165e145345c13108df

SHA512
b968f6ea673aba7ccc4dc139ffe2b1025019b563a3adcfe7ba9c52c5789a3bbf136e59f75a33b194f99be9ded67223b5c292f724b4ab5c36c26db1278079b91a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
896B

MD5
22d1125421fb90a55cac09771b463155

SHA1
bcf296264f3d511f062610242f3982d36cf1b2a9

SHA256
ecd349c8b8ac2c31376f695fe42fddc1c62bc1b994e05413a522ac083f1de8ea

SHA512
42b5a8fcba295c7d0d687f22bff9a02c79bf711dfbc824133976c06994f4a85f262297bf3dbcbc17ef86eddc81d277a0c819e470cf80bc592813b154be764155

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
22KB

MD5
3f8927c365639daa9b2c270898e3cf9d

SHA1
c8da31c97c56671c910d28010f754319f1d90fa6

SHA256
fc80d48a732def35ab6168d8fd957a6f13f3c912d7f9baf960c17249e4a9a1f2

SHA512
d75b93f30989428883cb5e76f6125b09f565414cf45d59053527db48c6cf2ac7f54ed9e8f6a713c855cd5d89531145592ef27048cf1c0f63d7434cfb669dbd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
39f50c68ac7a15493f59c81e83305068

SHA1
ac27ce30124fdf34d2443c9b952c371f13db57fe

SHA256
4dfc8d5c7131f94f790d4bc486a8a780e5b1bad73c35886fa08325a101e5c378

SHA512
98bff3bf0ea311606ddbc7b947e4f90daedfc7ae2d157dc1741d2781ee99db648ef4444fe1ed37aaadbc1b5a5bae322b13db9e7ff5d158437381d245c0b79b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
5d8773e20b16c1e9e6ab7ff88e2b27a8

SHA1
07122af13459c4ef4012d99ae649b8f251a15106

SHA256
12b7c1bea8a79817153b810613c64759b58d1ff8b2535fa8bb64e1804cc4a58f

SHA512
48c5df81121842b1e37c6fd6fe1b35085d1401d07a406001fda05331e4ba3a17a5947282b6410f90c5c9dc9604fdeacccd6d3c84f3b1f6cc4246f049938e44c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
31be9c5f5c62517a7070c9dd09d5545b

SHA1
1bce14bb9e02297bbe2ce723b31ba5970fcf24f2

SHA256
418851aec21d44b2a51fca02cb08ec68831655105941ef96b8930e51efb9c307

SHA512
7861e1fe8a64f05442d7788cd2c19f222ae3cd29267a66226ab01afdb4bfb4b3eb8bbab09eb02c885a7ba94ed95210d072e7fa254c08821dc51fce8494c2e3ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
42a4172fa4492434bf7a5de3a1f364e0

SHA1
0f346e0e51f35ffde897c2bdb9a6279371d70a2a

SHA256
ba985087fba3c00fefa93ff30da7e115bbbe023cd8e528e8458ab0e715ca1bd9

SHA512
dcdcc65590b50cb163282b854340fa34387c7b9cf147b0c83760b5984539c0a797911304e3bd60721633a41e078f0ef7625fecef714915c957bc99b66c3ca291

Download Submit
C:\Users\Admin\Downloads\release.zip.crdownload

Filesize
445KB

MD5
06a4fcd5eb3a39d7f50a0709de9900db

SHA1
50d089e915f69313a5187569cda4e6dec2d55ca7

SHA256
c13a0cd7c2c2fd577703bff026b72ed81b51266afa047328c8ff1c4a4d965c97

SHA512
75e5f637fd3282d088b1c0c1efd0de8a128f681e4ac66d6303d205471fe68b4fbf0356a21d803aff2cca6def455abad8619fedc8c7d51e574640eda0df561f9b

Download Submit
memory/4556-435-0x00000283834D0000-0x00000283834D1000-memory.dmp

Filesize
4KB

Download
memory/4556-434-0x00000283834D0000-0x00000283834D1000-memory.dmp

Filesize
4KB

Download
memory/4556-440-0x00000283834D0000-0x00000283834D1000-memory.dmp

Filesize
4KB

Download
memory/4556-439-0x00000283834D0000-0x00000283834D1000-memory.dmp

Filesize
4KB

Download
memory/4556-438-0x00000283834D0000-0x00000283834D1000-memory.dmp

Filesize
4KB

Download
memory/4556-437-0x00000283834D0000-0x00000283834D1000-memory.dmp

Filesize
4KB

Download
memory/4556-436-0x00000283834D0000-0x00000283834D1000-memory.dmp

Filesize
4KB

Download
memory/4556-430-0x00000283834D0000-0x00000283834D1000-memory.dmp

Filesize
4KB

Download
memory/4556-428-0x00000283834D0000-0x00000283834D1000-memory.dmp

Filesize
4KB

Download
memory/4556-429-0x00000283834D0000-0x00000283834D1000-memory.dmp

Filesize
4KB

Download
memory/5228-460-0x0000000000330000-0x0000000000338000-memory.dmp

Filesize
32KB

Download
memory/5228-462-0x0000000004DC0000-0x0000000004E52000-memory.dmp

Filesize
584KB

Download
memory/5228-463-0x0000000004D30000-0x0000000004D3A000-memory.dmp

Filesize
40KB

Download
memory/5228-461-0x00000000052D0000-0x0000000005876000-memory.dmp

Filesize
5.6MB

Download
memory/5364-418-0x000001E855100000-0x000001E855628000-memory.dmp

Filesize
5.2MB

Download
memory/5364-417-0x000001E854820000-0x000001E8549E2000-memory.dmp

Filesize
1.8MB

Download
memory/5364-416-0x000001E83A1C0000-0x000001E83A1D8000-memory.dmp

Filesize
96KB

Download