72d72607279e1add253c86dc2e664027dd1f495fbef456cb7415ef36dcf3901a | Triage

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04/07/2024, 12:57

Sharing

Report Analysis Logs

General

Target

NightyGo/NightyGo.exe
Size

12.7MB
MD5

1e19d9cab79ab2f7089e9b35c09c5de6
SHA1

dc8f115c2f077f2626f483a757d664b4a903af4a
SHA256

87defc7dde33f78c15ee397d1aaef962eaeb21236ebc5ef749a49904df0bd22d
SHA512

0dc41e4da2546fee7bd72982f6f514a44df2c47f4a0a40c0c18fd8d117600e3ed27b2972dacc3fb91c5211c7c7194427e9b19b3404cbfdfbe83342aa4dcb14a9
SSDEEP

196608:JcW9JRgNUMuhqtHv0Jrhn/l9Xm64wHGxoqXFCtoOUdN0nl:h9xW1WFnDMxoqwtoOSen

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2424	2580	NightyGo.exe	29
PID 2580 wrote to memory of 2424	2580	NightyGo.exe	29
PID 2580 wrote to memory of 2424	2580	NightyGo.exe	29

C:\Users\Admin\AppData\Local\Temp\NightyGo\NightyGo.exe
"C:\Users\Admin\AppData\Local\Temp\NightyGo\NightyGo.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\system32\cmd.exe
  cmd /C title NightyGo
  2⤵
  PID:2424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads