Analysis
- user interaction
yes - max time kernel
899s - max time network
900s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
07/10/2026, 10:42
General
- Target https://github.com/moom825/Discord-RAT-2.0
- Sample261007-mr3pdaxy4q
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTU1NjgwNjA3MDAzMzMxNzk1Mw.GUGHWo._WqJd8FzA98MU5oAouTA8yWvvfk9r9bpOqych0
-
server_id
1556803898474496050
Signatures
- Family: Discord RAT
A RAT written in C# using Discord as a C2.
- Executes dropped EXE 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 17 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 41 IoCs
- Suspicious use of SendNotifyMessage 32 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/moom825/Discord-RAT-2.01⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffa597ec188,0x7ffa597ec194,0x7ffa597ec1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,12255495597558118181,17015547279629186763,524288 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,6804792380987376775,14011716860960089661,262144 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,10342645871211818377,5364702077569582238,524288 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,12975047695375889854,14967951971170410116,2097152 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,13071531094495276507,628179348197116097,2097152 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,622078197787270262,10361428232808871270,524288 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,833675437936387418,10122250684899081732,524288 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,2374818530872123181,2728122408509243849,524288 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,2374818530872123181,2728122408509243849,524288 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,16960151148459070839,15269512888970404876,524288 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6284,i,17281146029172386155,10287951104894622524,2097152 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,13960287721544657627,15760833795601417052,524288 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3760,i,2766017942467137565,8123256689434514472,2097152 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=7156,i,17586620907885836689,9692032105449303979,2097152 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6768,i,18232098056583809803,7319250281611170761,2097152 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=1556 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7220,i,5257142301031860279,602354344063468568,524288 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=7208 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7224,i,347047953396382317,13135010228826926459,524288 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=7212 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7228,i,13750837684921267959,18199475577169259271,524288 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,12727259504416767577,17178758891418336411,524288 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7264,i,15471536639833659253,16208705730191201004,524288 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:82⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=2648,i,17874556845303197825,438028740200241985,2097152 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7584,i,4314029434259493689,6979862436436957235,524288 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=7572 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,14145784560845895738,6877160625304868675,524288 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5284,i,10482040323686814456,16334408722049158975,2097152 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2648,i,15999234011367091379,3123420718849912666,524288 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=7820 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7048,i,3783090664245331336,5081234607532990742,2097152 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=8024 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7652,i,4404641535064244903,11331422000497690871,262144 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,5763552556678145378,1338322929119150145,524288 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,9822430680871020506,11311084290414167625,524288 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,5716955978783137699,8376573327428015490,524288 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=4040 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=5492,i,14464929977875089283,10037127963554985396,2097152 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8172,i,8762688582077301183,4602027306783117659,2097152 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=5144,i,2593212566755893818,8644037214009888883,2097152 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7744,i,13271802767031173385,15230543513666361011,2097152 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8392,i,486856302518177433,8576601525419601244,524288 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=8308 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7124,i,16521255666018068602,5215376284292771337,524288 --field-trial-handle=2816,i,27249940267719008,6933494393368792065,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\release\builder.exe"C:\Users\Admin\Downloads\release\builder.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Downloads\release\Jarvis.exe"C:\Users\Admin\Downloads\release\Jarvis.exe"1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
1aeafc7d-90cf-4914-b386-5e393890ffd2.tmp
209f2c5a-b216-4d2e-ae5b-c77e14e8b2d2.tmp
35b762b4-db0b-4d07-872c-ef81e266fd54.tmp
3ab54190-7923-4433-8df3-84b3e43a639f.tmp
3f059ab6-72e7-49d9-9c6f-6f5b348ba49c.tmp
45191ac4-1eb7-49e8-82aa-7d90b321efcb.tmp
49be3e19-3258-4d64-802d-41d8e2f82eca.tmp
50fb0e84-172b-478d-88e7-cd730b3aa04b.tmp
69b94fdc-8942-44e2-8fd5-91e853192ba6.tmp
7c52b7df-67a3-4110-8b87-3964adf9192c.tmp
84025e4a-67bb-413d-9f94-f8e743407444.tmp
876e439e-41e0-43d0-a38a-6b7ad3e550f4.tmp
9f09c1d9-7ed5-47fe-8e2b-9089123ced39.tmp
settings.dat
settings.dat
0b84a9c7-8687-4530-8a77-c3486bd0b3e2.tmp
58420cef-9ab4-4ef8-b6de-eb5e24600045.tmp
64a3fbeb-2f6a-4b6c-8db2-543453423ae2.tmp
75b1a534-f9bf-4ce7-8c45-efb0975b87ed.tmp
80ecfb5c-2290-45d7-bf37-76c0721af6e0.tmp
9a783bc2-94da-4114-b84e-88d1a1905423.tmp
LOG
LOG.old
LOG.old
LOG.old
f_00006a
f_00006b
f_00006c
f_00006d
f_00006e
f_00006f
f_000070
f_000072
f_000074
f_000075
f_000076
f_000077
f_000078
f_000079
f_00007a
f_00007b
f_00007c
f_00007d
f_000080
f_000082
f_000084
f_000085
f_000086
f_000087
f_000088
f_00008a
f_00008b
f_00008c
f_00008d
f_00008f
f_000090
f_000091
f_000094
f_000095
f_000098
f_00009b
f_00009c
f_00009e
f_00009f
f_0000a1
f_0000a5
f_0000a8
f_0000ab
f_0000ad
f_0000ae
f_0000af
f_0000b0
f_0000b1
f_0000b2
f_0000b3
f_0000b5
f_0000b6
f_0000b7
f_0000b8
f_0000b9
f_0000ba
f_0000bb
f_0000bc
f_0000bd
f_0000be
f_0000bf
f_0000c1
f_0000c3
f_0000c4
f_0000c5
f_0000c6
f_0000c7
f_0000c8
f_0000c9
f_0000ca
f_0000cb
f_0000cc
f_0000cd
f_0000ce
f_0000d0
f_0000d1
f_0000d2
f_0000d3
f_0000d4
f_0000d5
f_0000d6
f_0000d7
f_0000d8
f_0000d9
f_0000db
f_0000dd
f_0000de
f_0000df
f_0000e0
f_0000e1
f_0000e2
f_0000e3
f_0000e4
f_0000e5
f_0000e6
f_0000e7
f_0000e8
f_0000e9
f_0000ea
f_0000eb
f_0000ec
f_0000ed
f_0000ee
f_0000ef
f_0000f0
f_0000f1
f_0000f2
f_0000f3
f_0000f4
f_0000f5
f_0000f6
f_0000f7
f_0000fa
f_0000fb
f_000102
f_000109
f_000137
f_000152
f_000161
f_000164
f_000165
f_000166
f_000167
f_000168
802803f7d010a9aa_0
bb663c6d0eab030f_0
temp-index
temp-index
temp-index
temp-index
temp-index
the-real-index
temp-index
dee8795c-a999-4813-b3c4-8c8067ab5bcc.tmp
000003.log
LOG
06de9028-e524-415e-b2be-cc5001dc23dd.tmp
07658061-50d8-4d26-8bf4-66daeff1d6a8.tmp
1c2e3c25-650f-4931-a5fe-b4b0198f7cf4.tmp
1d7755ec-b041-4aef-9108-3c5a8c369f62.tmp
27f20004-cc93-41f4-93cf-7678a3e470a4.tmp
4c196f47-33b8-49b8-9a67-33e8d29cc120.tmp
5a544a3a-5c2f-49aa-ad16-da1b840905a1.tmp
65a64ae2-25d5-43b0-b795-695f4d15ab19.tmp
66d876d0-814e-4c7d-a685-12ba4542ec2e.tmp
e15c9f4a-3aad-478d-89b8-f02d47a68e65.tmp
Preferences
040f11e49243b61d_0
06cbbe379d986136_0
06cbbe379d986136_1
09188314aa4f78e6_0
09188314aa4f78e6_1
093201eb3a338781_0
093201eb3a338781_1
0d0e2257e3d24e7d_0
0d0e2257e3d24e7d_1
123114fa59b53a18_0
123114fa59b53a18_1
179cc346c3c1505f_0
179cc346c3c1505f_1
1e09ebb2742c2b28_0
1e09ebb2742c2b28_1
31fdab2fbd316e2e_0
31fdab2fbd316e2e_1
4c2304f17be51ca3_0
4c2304f17be51ca3_1
5072ab8a6c4be45c_0
5072ab8a6c4be45c_1
5d35940960dc095c_0
5d35940960dc095c_1
88e0f6f5194e0e5b_0
88e0f6f5194e0e5b_1
9d63a03eec93ca3e_0
9d63a03eec93ca3e_1
9e3c57a7db9f4d34_0
9e3c57a7db9f4d34_1
abd853a435f12023_0
abd853a435f12023_1
babdf388927fab59_0
babdf388927fab59_1
c46c16bee7425a89_0
c46c16bee7425a89_1
c5793167c08d18e3_0
c5793167c08d18e3_1
dda2f3aebb721dd9_0
dda2f3aebb721dd9_1
e0b2a4fa3e626b49_0
e0b2a4fa3e626b49_1
e4a0a7419578ae0f_0
e4a0a7419578ae0f_1
e658c4f553883b9c_0
e658c4f553883b9c_1
e666cb307d4bb638_0
e666cb307d4bb638_1
e83141f6c7a28222_0
e83141f6c7a28222_1
f9b95615b3f74f8f_0
f9b95615b3f74f8f_1
temp-index
temp-index
temp-index
todelete_4f2277ea2139c475_0_1
temp-index
temp-index
the-real-index
todelete_59142ba814fd1c8a_0_1
temp-index
temp-index
the-real-index
todelete_4667722f745f9b27_0_1
todelete_f40c9eef63ff087e_0_1
temp-index
temp-index
temp-index
the-real-index
todelete_623cd082b6202da0_0_1
index.txt
index.txt.tmp
index.txt.tmp
index.txt.tmp
index.txt.tmp
temp-index
the-real-index
temp-index
the-real-index
index.txt
index.txt.tmp
index.txt.tmp
index.txt.tmp
4cb013792b196a35_0
4cb013792b196a35_1
temp-index
the-real-index
CURRENT
sync_diagnostic.log
MANIFEST-000001
temp-index
the-real-index
index
index.txt
index.txt.tmp
index.txt.tmp
index.txt.tmp
a2ba36fd-83eb-4c90-af93-671b4a589be4.tmp
aa5469f8-e889-4d27-86d2-527c2599c3d3.tmp
b5d0c44a-dd30-495f-9fd1-ff0339196889.tmp
c2be23c7-50c7-47d9-88f4-d400dde1dc86.tmp
cd93e07d-4682-4957-91e2-560a7494975f.tmp
RevisitationBloomfilter
a9ddecb2-549f-4f5a-91ab-68a0ce7cd713.tmp
c87f5c3b-14f4-4c86-a783-bed4f24574b9.tmp
e2ff2073-c1d6-43c4-b813-c57cd01a4936.tmp
ed95df6f-4b89-40a2-937f-8c0eb1cb22df.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
default.dic
YZEVMO038RZRQ55FRR10.temp
d6600c52-9d33-41b9-8747-03f2d4c63d5c.tmp
Client-built.exe
memory/4736-3995-0x0000000005880000-0x0000000005912000-memory.dmp
memory/4736-4117-0x0000000006CC0000-0x0000000006DE2000-memory.dmp
memory/4736-3996-0x0000000005810000-0x000000000581A000-memory.dmp
memory/4736-3994-0x0000000005D90000-0x0000000006334000-memory.dmp
memory/4736-3993-0x0000000000DF0000-0x0000000000DF8000-memory.dmp
memory/5608-4176-0x0000019AFEAB0000-0x0000019AFEAC8000-memory.dmp
memory/5608-4177-0x0000019AFFCD0000-0x0000019AFFE92000-memory.dmp
memory/5608-4178-0x0000019A999B0000-0x0000019A99ED8000-memory.dmp