c350062f096f6ea5f74e1476fca0472185dfb74c2f011f77508fdc12077d6788

Resubmissions

01/06/2026, 20:05

260601-ytvx4afy8k8

01/06/2026, 19:55

260601-ynfk8aet9w8

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/06/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nightcord.exe
Size 129.8MB
Sample260601-ynfk8aet9w
SHA256 c350062f096f6ea5f74e1476fca0472185dfb74c2f011f77508fdc12077d6788
MD5 eb1b498dabe79225bb1a0fd1e6a5967e
SHA1 2ddde8ffc349abfedf0462858ad16169757256f0
SHA512 295d26aaaebe5a259ae46486c691e8a72068e73b7f5bfa1abcd9de65947f532f27c21ec77b7d008d9dd20aac0367f5eb9bbc72c284c3ce802eecef4777527ed5
SSDEEP 1572864:rmYWQRWtJ65M7a2iu4Rywh9hJyO9N+oJOTU8f/kmgZ2sI:a4M7a2H4Ryu+dNgI
TLSH
T1D2587C03E29610D9F09DD1B59B468636DEB2BC454739A2DF2690271A2F7BFE0273DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	Nightcord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	Nightcord.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2168	Nightcord.exe
2168	Nightcord.exe
4252	Nightcord.exe
4252	Nightcord.exe
5116	Nightcord.exe
5116	Nightcord.exe
5116	Nightcord.exe
5116	Nightcord.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 2172	4760	Nightcord.exe	88
PID 4760 wrote to memory of 4252	4760	Nightcord.exe	89
PID 4760 wrote to memory of 2168	4760	Nightcord.exe	90
PID 4760 wrote to memory of 5116	4760	Nightcord.exe	108

C:\Users\Admin\AppData\Local\Temp\Nightcord.exe
"C:\Users\Admin\AppData\Local\Temp\Nightcord.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Users\Admin\AppData\Local\Temp\Nightcord.exe
  "C:\Users\Admin\AppData\Local\Temp\Nightcord.exe" --type=gpu-process --field-trial-handle=1600,14648082952586954959,5121547081805212372,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1608 /prefetch:2
  2⤵
  PID:2172
- C:\Users\Admin\AppData\Local\Temp\Nightcord.exe
  "C:\Users\Admin\AppData\Local\Temp\Nightcord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1600,14648082952586954959,5121547081805212372,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4252
- C:\Users\Admin\AppData\Local\Temp\Nightcord.exe
  "C:\Users\Admin\AppData\Local\Temp\Nightcord.exe" --type=renderer --field-trial-handle=1600,14648082952586954959,5121547081805212372,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2328 /prefetch:1
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  PID:2168
- C:\Users\Admin\AppData\Local\Temp\Nightcord.exe
  "C:\Users\Admin\AppData\Local\Temp\Nightcord.exe" --type=gpu-process --field-trial-handle=1600,14648082952586954959,5121547081805212372,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1116 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Nightcord Installer\Network Persistent State
Size 249B
SHA256 e247d5046e84b69e3f15391838d510e672222d50e5643488985756170a31d13a
MD5 6f80201b0846a23adcc443c8507d0836
SHA1 575389da53105e5af0b6288b98ab45b6e6a9e21f
SHA512 8acb078ea4808c148a10c3b981544530cdfbc910cc48e43359311bc9e10fe2525c2967f015fb47d172dda5047352bfaaf828bc942f7d254004d62769792fcfff
TLSH
T1E3D097BF17302CFF4342C3E4A5163A13C6FE004B125CBD4FA928372E41328BA880884B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe594915.TMP

Path C:\Users\Admin\AppData\Roaming\Nightcord Installer\Network Persistent State~RFe594915.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2172-2-0x00007FFA43360000-0x00007FFA43361000-memory.dmp

Download