Overview

overview

10

Static

static

10

NEXO OSINT TOOLS.exe

windows7-x64

10

NEXO OSINT TOOLS.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    177s
  • max time network
    183s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-04-2024 00:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NEXO OSINT TOOLS.exe

  • Size

    78KB

  • MD5

    26bbb735944110bb972f756f4ddf3043

  • SHA1

    dc4b9bc259eae6e2844f544eccc77d25b55643b6

  • SHA256

    97ffdc85eaf253b0bf73ff4c7218ba69c633163d68a8c81b1cca26d37413a2ec

  • SHA512

    3f95f8606a340c3998cc28c136af6b700976328f66d21f8159baca1258978e9ce8d6568c1796ae2a5067b9a66c5134640c759e737ee2e77505fcad7873dde513

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+PPIC:5Zv5PDwbjNrmAE+3IC

Score
10/10
discordratpersistenceratrootkitstealer

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTIyNTU4MTkxODM5ODE4NTQ5NA.Gw9CZ8.yYe5hL8D8XiPvhntF1xwye-frottc7F_HntHW0

  • server_id

    1222772434135158806

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEXO OSINT TOOLS.exe
    "C:\Users\Admin\AppData\Local\Temp\NEXO OSINT TOOLS.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4556
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:5108
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1036 --field-trial-handle=2256,i,9172343514068348080,519219714517961765,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:3924

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/4556-0-0x0000018B33E70000-0x0000018B33E88000-memory.dmp

        Filesize

        96KB

        Download

      • memory/4556-1-0x0000018B4E490000-0x0000018B4E652000-memory.dmp

        Filesize

        1.8MB

        Download

      • memory/4556-2-0x00007FFEDA530000-0x00007FFEDAFF1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4556-3-0x0000018B4E350000-0x0000018B4E360000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4556-4-0x0000018B4F580000-0x0000018B4FAA8000-memory.dmp

        Filesize

        5.2MB

        Download

      • memory/4556-5-0x00007FFEDA530000-0x00007FFEDAFF1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4556-6-0x0000018B4E350000-0x0000018B4E360000-memory.dmp

        Filesize

        64KB

        Download