Analysis
- max time kernel
899s - max time network
430s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
03/05/2026, 07:50
General
- Target NyxClient/NyxClient/NyxClient/.gradle/loom-cache/minecraftMaven/net/minecraft/minecraft-merged-c22ab.jar
- Size 30.1MB
- Sample260503-jprbsag13p
- SHA256 88e016a8c2734be1d5c699e39a44993c1dce5d0aaa801f98bdf70f09149aa7a6
Score
6/10
Malware Config
Signatures
- Network Service Discovery 1 TTPs 1 IoCs
Attempt to gather information on host's network.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exejava -jar C:\Users\Admin\AppData\Local\Temp\NyxClient\NyxClient\NyxClient\.gradle\loom-cache\minecraftMaven\net\minecraft\minecraft-merged-c22ab.jar1⤵
-
C:\Windows\System32\GameBarPresenceWriter.exe"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer1⤵
- Network Service Discovery
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2248-2-0x00000193E8470000-0x00000193E86E0000-memory.dmp
memory/2248-11-0x00000193E6BB0000-0x00000193E6BB1000-memory.dmp
memory/2248-13-0x00000193E8470000-0x00000193E86E0000-memory.dmp
memory/2248-12-0x00000193E6B90000-0x00000193E6B98000-memory.dmp