Analysis
- user interaction
yes - max time kernel
388s - max time network
370s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
- submitted
07/05/2026, 14:24
General
- Target Nightfall_Agent.exe
- Size 6.3MB
- Sample260507-rqt33aez21
- SHA256 56ce18954513f48c4bef79f79adf3ecb5e919bdc9fbc731f57ca1a4573f513e8
Malware Config
Signatures
- Loads dropped DLL 15 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 10 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies registry class 4 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nightfall_Agent.exe"C:\Users\Admin\AppData\Local\Temp\Nightfall_Agent.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Nightfall_Agent.exe"C:\Users\Admin\AppData\Local\Temp\Nightfall_Agent.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.131⤵
- Modifies registry class
-
C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\wt.exe"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.WindowsTerminal_8wekyb3d8bbwe\wt.exe" -d "C:\Users\Admin\Desktop\."1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exewt.exe -d "C:\Users\Admin\Desktop\."2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wsl.exeC:\Windows\system32\wsl.exe --list3⤵
-
-
C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe" --headless --win32input --resizeQuirk --width 120 --height 27 --signal 0xa18 --server 0xa143⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ba1b72ee-d6d6-47a3-812a-50e597d1f140.down_data
81d243bd2c585b0f4821__mypyc.cp310-win_amd64.pyd
VCRUNTIME140.dll
_bz2.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
base_library.zip
cacert.pem
cd.cp310-win_amd64.pyd
libcrypto-1_1.dll
libssl-1_1.dll
python310.dll
select.pyd
unicodedata.pyd
__PSScriptPolicyTest_a3c2di0c.p5i.ps1
memory/992-89-0x000001F868A00000-0x000001F868A1A000-memory.dmp
memory/992-88-0x000001F868770000-0x000001F86877A000-memory.dmp
memory/992-75-0x000001F8687B0000-0x000001F8687F6000-memory.dmp
memory/992-84-0x000001F868780000-0x000001F86879C000-memory.dmp
memory/992-85-0x000001F868900000-0x000001F8689B3000-memory.dmp
memory/992-86-0x000001F868760000-0x000001F86876A000-memory.dmp
memory/992-87-0x000001F8689E0000-0x000001F8689FC000-memory.dmp
memory/992-74-0x000001F868350000-0x000001F868372000-memory.dmp
memory/992-99-0x000001F84FC30000-0x000001F84FC3C000-memory.dmp
memory/992-90-0x000001F8687A0000-0x000001F8687A8000-memory.dmp
memory/992-91-0x000001F8689C0000-0x000001F8689C6000-memory.dmp
memory/992-92-0x000001F8689D0000-0x000001F8689DA000-memory.dmp
memory/992-93-0x000001F84FC30000-0x000001F84FC3C000-memory.dmp
memory/992-94-0x000001F84FF80000-0x000001F84FF92000-memory.dmp
memory/1584-50-0x000001AF3B160000-0x000001AF3B16C000-memory.dmp