Analysis
- max time kernel
135s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
28/03/2024, 17:13
General
- Target nyxo_aimlock.exe
- Size 78KB
- Sample240328-vrp3aabd91
- SHA256 35afb2b65e7371130bd99515da2b695a009821c60d1006ea6bde3ee9532f842b
Malware Config
Extracted
-
discordrat
-
discord_token
MTIyMjkzMTA2MzM4NzQ1NTUzOQ.GzvyiO.hWpvwSRqDF9zcO06McTFnTajKVkIy7Qs1p6kmw
-
server_id
1222930826723987619
Signatures
- Discord RAT
A RAT written in C# using Discord as a C2.
- Downloads MZ/PE file
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 19 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\nyxo_aimlock.exe"C:\Users\Admin\AppData\Local\Temp\nyxo_aimlock.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C whoami2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77nyxo_aimlock.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\nyxo_aimlock.exe'" /sc onlogon /rl HIGHEST2⤵
- Creates scheduled task(s)
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4276-0-0x0000021C641A0000-0x0000021C641B8000-memory.dmp
memory/4276-1-0x0000021C7E930000-0x0000021C7EAF2000-memory.dmp
memory/4276-2-0x00007FFCCDF00000-0x00007FFCCE9C1000-memory.dmp
memory/4276-3-0x0000021C65FF0000-0x0000021C66000000-memory.dmp
memory/4276-4-0x0000021C7F130000-0x0000021C7F658000-memory.dmp
memory/4276-5-0x00007FFCCDF00000-0x00007FFCCE9C1000-memory.dmp
memory/4276-6-0x0000021C65FF0000-0x0000021C66000000-memory.dmp
memory/4276-7-0x0000021C7F760000-0x0000021C7FA2A000-memory.dmp