c350062f096f6ea5f74e1476fca0472185dfb74c2f011f77508fdc12077d6788

Resubmissions

01/06/2026, 20:05

260601-ytvx4afy8k8

01/06/2026, 19:55

260601-ynfk8aet9w8

Analysis

max time kernel
148s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nightcord.exe
Size 129.8MB
Sample260601-ynfk8aet9w
SHA256 c350062f096f6ea5f74e1476fca0472185dfb74c2f011f77508fdc12077d6788
MD5 eb1b498dabe79225bb1a0fd1e6a5967e
SHA1 2ddde8ffc349abfedf0462858ad16169757256f0
SHA512 295d26aaaebe5a259ae46486c691e8a72068e73b7f5bfa1abcd9de65947f532f27c21ec77b7d008d9dd20aac0367f5eb9bbc72c284c3ce802eecef4777527ed5
SSDEEP 1572864:rmYWQRWtJ65M7a2iu4Rywh9hJyO9N+oJOTU8f/kmgZ2sI:a4M7a2H4Ryu+dNgI
TLSH
T1D2587C03E29610D9F09DD1B59B468636DEB2BC454739A2DF2690271A2F7BFE0273DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4624	Nightcord.exe
4624	Nightcord.exe
2988	Nightcord.exe
2988	Nightcord.exe
616	Nightcord.exe
616	Nightcord.exe
616	Nightcord.exe
616	Nightcord.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 3260	2104	Nightcord.exe	80
PID 2104 wrote to memory of 4624	2104	Nightcord.exe	81
PID 2104 wrote to memory of 2988	2104	Nightcord.exe	82
PID 2104 wrote to memory of 616	2104	Nightcord.exe	84

C:\Users\Admin\AppData\Local\Temp\Nightcord.exe
"C:\Users\Admin\AppData\Local\Temp\Nightcord.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Users\Admin\AppData\Local\Temp\Nightcord.exe
  "C:\Users\Admin\AppData\Local\Temp\Nightcord.exe" --type=gpu-process --field-trial-handle=1564,12569874796651043486,14939914972600369061,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1576 /prefetch:2
  2⤵
  PID:3260
- C:\Users\Admin\AppData\Local\Temp\Nightcord.exe
  "C:\Users\Admin\AppData\Local\Temp\Nightcord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1564,12569874796651043486,14939914972600369061,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4624
- C:\Users\Admin\AppData\Local\Temp\Nightcord.exe
  "C:\Users\Admin\AppData\Local\Temp\Nightcord.exe" --type=renderer --field-trial-handle=1564,12569874796651043486,14939914972600369061,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2264 /prefetch:1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2988
- C:\Users\Admin\AppData\Local\Temp\Nightcord.exe
  "C:\Users\Admin\AppData\Local\Temp\Nightcord.exe" --type=gpu-process --field-trial-handle=1564,12569874796651043486,14939914972600369061,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3200 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4864

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Nightcord Installer\Network Persistent State
Size 249B
SHA256 e247d5046e84b69e3f15391838d510e672222d50e5643488985756170a31d13a
MD5 6f80201b0846a23adcc443c8507d0836
SHA1 575389da53105e5af0b6288b98ab45b6e6a9e21f
SHA512 8acb078ea4808c148a10c3b981544530cdfbc910cc48e43359311bc9e10fe2525c2967f015fb47d172dda5047352bfaaf828bc942f7d254004d62769792fcfff
TLSH
T1E3D097BF17302CFF4342C3E4A5163A13C6FE004B125CBD4FA928372E41328BA880884B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe596354.TMP

Path C:\Users\Admin\AppData\Roaming\Nightcord Installer\Network Persistent State~RFe596354.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3260-2-0x00007FF8013E0000-0x00007FF8013E1000-memory.dmp

Download