discordrat | 9a8bfdc495a216a9c4042522796043ffc7f4651153d369cf3fd3637ec35190e2

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
28-03-2024 17:13

Target

nyxo_aimlock.exe
Size

78KB
MD5

3e7ddc5f7fad580b7d36bd80714c343d
SHA1

f2943c1c5024da64c5e077e5a2c4139f661f3cce
SHA256

35afb2b65e7371130bd99515da2b695a009821c60d1006ea6bde3ee9532f842b
SHA512

e7e706ae8d1e892a5e2b542e23419c9c030fa654c06a8e955ea64a5fad0c5e1fa094332a36f24d978e02d812e428d2b91e97fe6f8a26a80f67dffbc5b1c360c0
SSDEEP

1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+kPIC:5Zv5PDwbjNrmAE+4IC

Score

10^/10

Family

discordrat

Attributes

discord_token
MTIyMjkzMTA2MzM4NzQ1NTUzOQ.GzvyiO.hWpvwSRqDF9zcO06McTFnTajKVkIy7Qs1p6kmw
server_id
1222930826723987619

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2724	2484	nyxo_aimlock.exe	28
PID 2484 wrote to memory of 2724	2484	nyxo_aimlock.exe	28
PID 2484 wrote to memory of 2724	2484	nyxo_aimlock.exe	28

C:\Users\Admin\AppData\Local\Temp\nyxo_aimlock.exe
"C:\Users\Admin\AppData\Local\Temp\nyxo_aimlock.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2484 -s 596
  2⤵
  PID:2724

memory/2484-0-0x000000013FED0000-0x000000013FEE8000-memory.dmp

Filesize
96KB

Download
memory/2484-1-0x000007FEF5C60000-0x000007FEF664C000-memory.dmp

Filesize
9.9MB

Download
memory/2484-2-0x000000001B4F0000-0x000000001B570000-memory.dmp

Filesize
512KB

Download
memory/2484-3-0x000007FEF5C60000-0x000007FEF664C000-memory.dmp

Filesize
9.9MB

Download
memory/2484-4-0x000000001B4F0000-0x000000001B570000-memory.dmp

Filesize
512KB

Download
memory/2484-5-0x000007FEF5C60000-0x000007FEF664C000-memory.dmp

Filesize
9.9MB

Download