Analysis
-
max time kernel
899s -
max time network
440s -
platform
windows10-ltsc_2021_x64 -
resource
win10ltsc2021-20250314-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system -
submitted
17/04/2025, 12:50
Behavioral task
behavioral1
Sample
kernel.exe
Resource
win10ltsc2021-20250314-en
windows10-ltsc_2021-x64
8 signatures
900 seconds
General
-
Target
kernel.exe
-
Size
78KB
-
MD5
2d1d18365fe1c507b677de17323f08b1
-
SHA1
83418952aa584c29309853280db5b64dcc812535
-
SHA256
b9e94e44768a73aacf68786118d898dfb3f2c7223737b2a41ea3aa3f1debcabd
-
SHA512
db14d84fb1267ccd6d9b0de68e9faebb10841728300cea831b297f710084962292c6786a2a4c0ec00c1f921169d5a032675d048c6dd5ca2c8055e07bb2d26f1f
-
SSDEEP
1536:58+ycDpi6qczE62Ti0F6/076q5lS7pHacGiNPAQHVhampStsuGanHrRY7fg0pUDu:5jycDpi6qczE62TxF6/076q5lS7pHacn
Score
10/10
Malware Config
Extracted
Family
discordrat
Attributes
-
discord_token
MTM2MjQwNzY0NzA1MTI1MTc3Mg.G-bYfp.u0DPoJkBL0aIvMvFjYtsKR8zIUixwvPB4WsTYg
-
server_id
1351601990072795178
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Discordrat family
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5348 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 252 kernel.exe Token: SeDebugPrivilege 5348 taskmgr.exe Token: SeSystemProfilePrivilege 5348 taskmgr.exe Token: SeCreateGlobalPrivilege 5348 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe 5348 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\kernel.exe"C:\Users\Admin\AppData\Local\Temp\kernel.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:252
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5348