Analysis
-
max time kernel
135s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
28-03-2024 17:13
General
-
Target
nyxo_aimlock.exe
-
Size
78KB
-
MD5
3e7ddc5f7fad580b7d36bd80714c343d
-
SHA1
f2943c1c5024da64c5e077e5a2c4139f661f3cce
-
SHA256
35afb2b65e7371130bd99515da2b695a009821c60d1006ea6bde3ee9532f842b
-
SHA512
e7e706ae8d1e892a5e2b542e23419c9c030fa654c06a8e955ea64a5fad0c5e1fa094332a36f24d978e02d812e428d2b91e97fe6f8a26a80f67dffbc5b1c360c0
-
SSDEEP
1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+kPIC:5Zv5PDwbjNrmAE+4IC
Malware Config
Extracted
discordrat
-
discord_token
MTIyMjkzMTA2MzM4NzQ1NTUzOQ.GzvyiO.hWpvwSRqDF9zcO06McTFnTajKVkIy7Qs1p6kmw
-
server_id
1222930826723987619
Signatures
-
Discord RAT
A RAT written in C# using Discord as a C2.
-
Downloads MZ/PE file
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 19 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\nyxo_aimlock.exe"C:\Users\Admin\AppData\Local\Temp\nyxo_aimlock.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C whoami2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77nyxo_aimlock.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\nyxo_aimlock.exe'" /sc onlogon /rl HIGHEST2⤵
- Creates scheduled task(s)
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
5.2MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
2.8MB