����d-�"���?�ҷ�@�/c� l:�����}:鰌�������q���:Z\��y��K�c�v,2������S/R�v/�5��"b��YⱢ'���ެ��l��ԅ����,��B��j}�gc)xʟ�X��1)������B�j�f^�<�'�r�n��m��̀F��'R�T�dBw���XYG�m7�����D��Jj^�1��!�Z}��� ��Yi��?F)o(5�>�>w`;?��-�w8�1��cͷ�� S}Oz��){3^�F g�7�3/���G Y��"tU֢Q�sD���]%��zN|��=��V��BN�bv�AmSC�h�w��c�8w���y�R����<�Nj���.n2��F|���Pˡhմ!mWb�j��x�l/U�w���FN0#�L$���<��I'Y���\b��eU�D$��;���2���SZ�1����y9�Ǣ�T��c���PbY��`U"sv�j'x� -�����hv���l��6�������������;-c!���*m� w���n}ws\P����i���K�����4����6v$����_O�a�4�,��.���i���/ɲ\KBE+�ea�U�3����U�ıϹ�y�����˂�};Q/W�R��K�E6@$�՜�Qy���~��-s�Ꮑ��7̈́Ĝ=ϵ����Q���Z*Ay���B�(�"�֑:}�Ֆ^[�����9 K����VM���p|T�6t��U��C�����c�~����"y��e��)x̳h��P���ͨ]3N�E#�I�O3GB:v�"rM[����_�ϊJ�Ӟ�C����BP�Ӗ1�Yޣ�`�[1��3BX��D �툝������+��Ҟ�F�ÒD9߰�K'�2��C�f�������|�|OW���L���������y���unb�hM�U^rғ���G�M�pFL����������� /1����FX[�Fɞ�����V��Q˰U i/Һ����_��Ij�`j�/�6�g4+r.x��}������Ν���2�Pg����� ���k��E��������6��/�����[,�ly�Ȝ��rG����IV��v���j�ב�Z�Ra�0��,�)�>��~�MD��������U���_�H�l<��O���}B�_�q&���)n9��y�糭��j����rH�G��Ƀ�R��ޖV�2*y��n5�Q���/~�~�s,{�W�k�c5�TDD���c:�a4�|*7��9ӵfb����6�~! R89����5A��}9���,\�i��D���A�zظ~�5*�@��6 �{ܽ�f����p9���+ N��b�b�!�>����� c��� NY1P����b}JF�V��w-Y�5nk���+i�Q1@���S�.��5��\����W،o��C 3�]���3� ���|�w9���4>��n#XL� �|��S1'�Ud�M��&K�+?F�`�(�u�f�g�*e �*�I�S%rx?��\e�yab�k�8������`�> }3��l�oE=�I��(h1��cS�s�U� �%���� ���^|�{�-t�dZ(p�����\�����̽SA��U�BU�h�;Ӭ%����=�Dw�*�l�DZ'���i���@Y���/%l}����3�3.+�3,����z =V���f��V=Е Ҿ1�(��s���h;��a���w���$ɨ0�FTR=��qq��}Hd��;ַ������v<�4�'p� ���T��wgͻ��L$�0&��R�m�;Jæ�U��iG'�*�%_�ϻ\P8��~h������LuU�v��GS̶�h�`����V�qu�`�A[w��G}�]����X����<��B ���E��X�M����W�z��ȃrtCH`�@�Ā�������-�"�u��L`{c-iJ�n�� ͅ��%+��U�A3���4�=��c��[MD�_◫Tw��O��S�oE�y�Q ��������*���q����6��+��`��[H���=�8�i�&�ݙl�7���4)���s��5��J��{2{��dp<��}�yW����]G~�����0���s�G]t-��.�GT��J���@B�a���C���7,X5y�LF�1$�+��"��л�;�?c�^{:��&�$f�u$-|��~]K]��U�A L�{�;�A�xYi��t*��$30��t��1j��W�|�B���2�9e��x��U����d����ɼ[�Z�w�e�R ���"���Yf �%��p��{飳E���[Ϸ�����s� ��Z����ϟ��|)^B��Gf��q�@e�Z�;��}}���Sy��M=��hz����]Ă��dneJߠPG�P>����O��������̜�3��8����Ɗ�T6�ӷ�K��T� ����M�aKB�t�8iWC�u�� g�!��1�X�����y�3:�m�AG�{��r���vz�")�b���c�!!�����g��GQ�?M��&w@01h� ���D}z�b�Ӄ�,�58��v��_\�"�����x�Q=�U���Z��C�f�;�(��j�)�K`�xN�ސ��d�H�C��{$fT�<����?��cltȳw�:�pb�"�����B�uU�ʚ$0|g��I9>j���-V�O�q��e�rBϛ�J0�����:pn�D(�h��Fz�wo?�Z����1t�A)�z���|� �*Y}A�qLx:�'�j9 xW��'X�ok���8Ԅ�I^ �F]�d9�'���Oq����A�����@�;"r�;��W���wn�ʕ��ςñQ*�f�M����������es������?^_vH�q��=�2)OfRF�>�ߝK�l>�a��s-�9ߏ�-d��?������H)6V����t�$��������?�B|^`���>+X���b�Z���F$~Yl�VjM���u�m�I{|Y<���qV%�k[7#�?^�^]��q�f��C|(�-�T�I+$6�L����F�/����j�ɛn��>(k��f?�N��潳\�����{>o0�:/�c�ʘ�q�^X̆!!� �s�I�2��i��r�����U��IR��[�f���|o�M|3���
Static task
static1
Behavioral task
behavioral1
Sample
night.exe
Resource
win10-20240611-en
Behavioral task
behavioral2
Sample
night.exe
Resource
win10v2004-20240709-en
General
-
Target
night.exe
-
Size
83.7MB
-
MD5
ad86b51aedf962606b2400a749e5fcf1
-
SHA1
1370cfc275759acc882c0a9cc16ef545c24e84ac
-
SHA256
b2afcc26a9ec50dfd796dcd1e321627ebd36fa9a94236a555aa839e84210f76e
-
SHA512
c8f3439bb48875ab2b30d84880116d202bd22b2ed26071499fc645998dc1a74fd37c20c8f474f17ecb0337420a8696735dfcc36968d74bfd220df515e2a9c6b5
-
SSDEEP
1572864:N7IGS4k+sKVf18r6hRhGKTCdXGN2xxF7NMq8gqTfe+jqBJXcY66gcV:9IdsVfKeVGk0W2DFRMqMpqBJJ3gc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource night.exe
Files
-
night.exe.exe windows:5 windows x64 arch:x64
f9f5627128ad2ebb8e63e2dfb55048e0
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Imports
advapi32
GetSecurityInfo
bcrypt
BCryptCloseAlgorithmProvider
kernel32
CloseHandle
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcrt
__C_specific_handler
ole32
CoTaskMemFree
shell32
SHGetKnownFolderPath
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: - Virtual size: 74.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pdata Size: - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.xdata Size: - Virtual size: 94KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 3KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.xpdata0 Size: - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.xpdata1 Size: 83.6MB - Virtual size: 83.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ