Analysis
- max time kernel
65s - max time network
69s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
02/08/2026, 10:37
Errors
General
- Target Henix.exe
- Size 82KB
- Sample260802-mn8ffsgq81
- SHA256 7ded292cd82649ab41c6d287b066369dbd705bfdfd1bd9510cf276e7659a85b9
Malware Config
Extracted
-
discordrat
-
discord_token
MTUzMjg2MTYwNDkyNjg0OTAyNQ.GxoO57.-Rc-as6syjYZUw_Q7_lEIyA6A23V6SsbFbBk4g
-
server_id
1532861394809126912
Signatures
- Family: Discord RAT
A RAT written in C# using Discord as a C2.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Disables Task Manager via registry modification
- Downloads MZ/PE file 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 10 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies data under HKEY_USERS 4 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{3a149d2f-66aa-4a55-8f37-c2f769e3a254}2⤵
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a26055 /state1:0x41c64e6d2⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Henix.exe"C:\Users\Admin\AppData\Local\Temp\Henix.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Downloads MZ/PE file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Henix.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\Henix.exe'" /sc onlogon /rl HIGHEST2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\shutdown.exe"C:\Windows\System32\shutdown.exe" /s /t 02⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Henix.exe"C:\Users\Admin\AppData\Local\Temp\Henix.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3776-19-0x00007FFBB2220000-0x00007FFBB2BC4000-memory.dmp
memory/3776-28-0x00007FFBB2220000-0x00007FFBB2BC4000-memory.dmp
memory/3776-23-0x00007FFBB2220000-0x00007FFBB2BC4000-memory.dmp
memory/3776-22-0x00007FFBB2220000-0x00007FFBB2BC4000-memory.dmp
memory/3776-21-0x00007FFBB2220000-0x00007FFBB2BC4000-memory.dmp
memory/3776-20-0x00007FFBB2220000-0x00007FFBB2BC4000-memory.dmp
memory/4376-7-0x00007FFBB2220000-0x00007FFBB2BC4000-memory.dmp
memory/4376-17-0x00007FFBB2220000-0x00007FFBB2BC4000-memory.dmp
memory/4376-8-0x000001F975A10000-0x000001F975F38000-memory.dmp
memory/4376-9-0x00007FFBB2220000-0x00007FFBB2BC4000-memory.dmp
memory/4376-10-0x00007FFBB2220000-0x00007FFBB2BC4000-memory.dmp
memory/4376-11-0x00007FFBB2220000-0x00007FFBB2BC4000-memory.dmp
memory/4376-12-0x00007FFBB2220000-0x00007FFBB2BC4000-memory.dmp
memory/4376-13-0x00007FFBB2220000-0x00007FFBB2BC4000-memory.dmp
memory/4376-14-0x00007FFBB2220000-0x00007FFBB2BC4000-memory.dmp
memory/4376-15-0x00007FFBB2220000-0x00007FFBB2BC4000-memory.dmp
memory/4376-16-0x00007FFBB2220000-0x00007FFBB2BC4000-memory.dmp
memory/4376-1-0x000001F972A80000-0x000001F972A98000-memory.dmp
memory/4376-18-0x00007FFBB2220000-0x00007FFBB2BC4000-memory.dmp
memory/4376-6-0x00007FFBB2220000-0x00007FFBB2BC4000-memory.dmp
memory/4376-5-0x00007FFBB2220000-0x00007FFBB2BC4000-memory.dmp
memory/4376-4-0x00007FFBB2220000-0x00007FFBB2BC4000-memory.dmp
memory/4376-3-0x00007FFBB2220000-0x00007FFBB2BC4000-memory.dmp
memory/4376-0-0x00007FFBB23AF000-0x00007FFBB23B0000-memory.dmp
memory/4376-24-0x000001F9747E0000-0x000001F97481E000-memory.dmp
memory/4376-26-0x00007FFBD3B20000-0x00007FFBD3BE7000-memory.dmp
memory/4376-25-0x00007FFBD5080000-0x00007FFBD52E3000-memory.dmp
memory/4376-29-0x00007FFBB2220000-0x00007FFBB2BC4000-memory.dmp
memory/4376-2-0x000001F975210000-0x000001F9753D2000-memory.dmp
memory/4548-27-0x0000000140000000-0x0000000140040000-memory.dmp