Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
6Static
static
3NightyGo.rar
windows7-x64
3NightyGo.rar
windows10-2004-x64
3NightyGo/NightyGo.exe
windows7-x64
1NightyGo/NightyGo.exe
windows10-2004-x64
1NightyGo/config.json
windows7-x64
3NightyGo/config.json
windows10-2004-x64
3NightyGo/d...nd.mp3
windows7-x64
1NightyGo/d...nd.mp3
windows10-2004-x64
6Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2024, 12:57
Static task
static1
Behavioral task
behavioral1
Sample
NightyGo.rar
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
NightyGo.rar
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
NightyGo/NightyGo.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
NightyGo/NightyGo.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
NightyGo/config.json
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
NightyGo/config.json
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
NightyGo/data/nitrosound.mp3
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
NightyGo/data/nitrosound.mp3
Resource
win10v2004-20240508-en
General
-
Target
NightyGo/NightyGo.exe
-
Size
12.7MB
-
MD5
1e19d9cab79ab2f7089e9b35c09c5de6
-
SHA1
dc8f115c2f077f2626f483a757d664b4a903af4a
-
SHA256
87defc7dde33f78c15ee397d1aaef962eaeb21236ebc5ef749a49904df0bd22d
-
SHA512
0dc41e4da2546fee7bd72982f6f514a44df2c47f4a0a40c0c18fd8d117600e3ed27b2972dacc3fb91c5211c7c7194427e9b19b3404cbfdfbe83342aa4dcb14a9
-
SSDEEP
196608:JcW9JRgNUMuhqtHv0Jrhn/l9Xm64wHGxoqXFCtoOUdN0nl:h9xW1WFnDMxoqwtoOSen
Malware Config
Signatures
-
Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 680 Process not Found -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4836 wrote to memory of 1164 4836 NightyGo.exe 81 PID 4836 wrote to memory of 1164 4836 NightyGo.exe 81