���'��������:�X$������鲊��w����1t��`C�o�����v�&�_")��6�?�y��;0|���T�7�#d�;ČYW����� ���P�l7�1���`�Nu>H>�i_r�P��^�Q簾��b�C `=I��n���a^�\�7���ߖU�5Z���Z��[����8�&-���b[~� �K��w9A��L�ʉ��*x��lj>v�*\���o�=�I�]��p�9��秶�AS�{�� ��J.Q���ֻ�R�'�1'��>P��丹��fό" .���J�F�"tCO�H�����_O��n���.�-� ����G}��}���32��~L���}Z�46܋ޥ-o���l�-�i�)M ?�,���%�����.B�i����N�-֣�1�t���R<��o��D��N��M�b7Eg�T䔊K�+���k��Y�����w�)�U�)�'\vz���m�k*��-������SP��px�����}FeB�Ѹ!�:�+)��^�U��K���ț��6�ʥ�d��ϐT�����D����ǚ�>,�,�d����!7c-�z��˙��#�����U: �rp0�Y"���4���;-<Ռ%[���~��?/k� 2�Bˎ��Ku5![o��M�^@O��18Őx���4s�z�c@�賈*��7�7��][u�WY3{+��3%G:?�� ّ$b)y�^�����]�;ح�3��D)�2�<�Z�I}3���^%����Z�r8j��o�6~��H�oU�7���_A%YZu$�y' z}v�Z��9�?y��'[�X����8%�g됯o>7�ؾ�D���-��ȸ�=�_�?��ǒP�!�m�_)T�x*^.�p�`d�6�uLSU�� �{B����'S�a��wLWVr3�{]{��A��x��,�э> �Ϭڰ�/�c,`tA��c@��Jz����耖jq��\�cѢ$�������$�b� �5�9��ж���q�6�F��qH:>���nX��x�2���{Ԩ��~l����52;���b,t+������<���-��Y���m�N07g�&�VN2RB;� >�3���(���< 3�����o*���?����#f�;�4��#2�<�l���_؛랣��A=R�B��9�I0/�T�5�^MTk�Z"3�]tr�o�{�7��dpF��B�o�1<�]�%�n�a ����ː<���uH�� ���3�[��3P�EB=�ER��F����{���o2��at�%����d<z�����*0E����_8�+�BZ*���=/�.At�0��Ϻ�� �y#�����%�䜣�-C���?Y97�� l�x��?� M�nj��2��I��FN��R������Ğ���?�&������F4��f3] ��/�=�<�������� h���B���R�^Ý���i������l�;�h��z���>pA�*��Q�V�[4;��? ��O�ūT��p��u+w�p%W]z\����ɮ�x���@ù�����ԑR��4�h=P�&�`��,��<�@'B؈�4�U+�� �}3�����ڃ�q�B Jq�`F�������[��2o�{�`����_d���o^��� �f�%u�%~(�շ.C�,���/"B^��' TJ�w����{g�K3��l�5���W����ћ��!>s$$K�4� ���Aӥ��Y�)�W��`�ǯ�srK���Ս����&��S�m��l����j��W>�m�����^ܝI��[��AS�v�;p�� �4� q�E(���"I 7����� ��Vg���.����ôu��-"4둘h)�!*]?)t�;Lus���Ѻ![5P�(����<�wp���!Tס��5Pg'����k������+�3�+��W�*X��=��U]��t#h�p�:�ĖU̠H-э5`JPCf��p]�^��01�� ����ve�n�fP. ;r���Kp����]F�4�����P��kgi�W�������]���EP_f%.p�'u Uo+Cڿջ�N)^���4 >�`5�����F��#�Z,6��_�U<���ٛ[LJكn�)z�t�i��S�"b����H�1k��� ��ϋ���]9WZ��+��GeޡA3��[�*���-� eT�,$�dl��|�'o��l��\D�c�L�m:]a� U��#Wq5��,Β�C�H�l�3(T䙕8�\��VYo3 z�օ�h`�ьJ6��+��<���9ĄFʵȖ� Ţ���ʟp>X�� �������QH�/�}�df�d6L��5g�"�~j����Q��w|���0�AykC�74Mq!���i̳�b�R-���(��3��p�O���c�òU�>90zkӄ���(2\�7���n��&�M��2& �RL�^��si�����6N����Qh(���B��t�����V���ͥe�}<�ͷ8�M^M���0"1m��b ���sSd�L��!�ŲP��6֢�otgS�w���Pu�5�����4���Vm�R��Ӑh�>i�鶮d�.�ƅ�� �lX�ۭ7�?q���z�� �k'�]�ᰛP)h��C_+�Eh��ƅ� :�-�%�f�1:Gs:{�Jݥ�´�Ly�N�uK�6-�DA6�&'ϗ����LZ)x�ve�<7MMk�[ ���w�[qoi]b^eN�ml��Vɴ3�ڟH%ϼ�ѻ��xP�R>tc��>���5\�Ǩ"sA�h*e���a}��#a�E,@�k���h X�E@�9�8v'}�q�J�B6�;1Dd�%�"�^G���>�$������뚓���m��I�6�fט]��������ӵ(����Q���e����2��c�#>��(B~M,��ug{��6���P��)���r��sC�ѧ��k���dN���:��y��z���;GR��N����� ����Kf�E��OA��3�hé"�Hj�Eϟ}u&ط;P�]-z$R��ͦ^+s���{���b������3U�4cNhn�Gnv�4�M��x)얆�Z�)n����O������sEi!�BH,��*�A���wy���v�c�d�q䥷`4b���F�
Static task
static1
Behavioral task
behavioral1
Sample
Midnight.exe
Resource
win10v2004-20240709-en
General
-
Target
Midnight.exe
-
Size
13.4MB
-
MD5
9e9e66167f795090708b5f4b54351e56
-
SHA1
09e1881dff8cfe5fcf7535977d476a49bdd891bb
-
SHA256
02f680e0f8042a24b1f4a262a0b1c1b0632dea6abce0009afd5058ffffb08f10
-
SHA512
0c01981e27ec4beb85c7f85b66db717120a60e619f6b47868963c91012f5a3053ac20a58d229afe743739b1ef08f1d8d43cf8829ff2438e7adf4670c47711494
-
SSDEEP
393216:O391LKh9OqHrBPShVukSDNUj6mISgiNG15yX1Mntue:U2h99LBPSh0kSDN7mXgIG1cX1Mnt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Midnight.exe
Files
-
Midnight.exe.exe windows:6 windows x64 arch:x64
cb67302686be25146acab094a4dcb34b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
shell32
SHFileOperationW
kernel32
EnterCriticalSection
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
wtsapi32
WTSSendMessageW
user32
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
.text Size: - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 500B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.loader0 Size: - Virtual size: 11.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.loader1 Size: 13.3MB - Virtual size: 13.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 108KB - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ