c350062f096f6ea5f74e1476fca0472185dfb74c2f011f77508fdc12077d6788

Analysis

max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/06/2026, 21:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nightcord.exe
Size 129.8MB
Sample260620-1kssgsay21
SHA256 c350062f096f6ea5f74e1476fca0472185dfb74c2f011f77508fdc12077d6788
MD5 eb1b498dabe79225bb1a0fd1e6a5967e
SHA1 2ddde8ffc349abfedf0462858ad16169757256f0
SHA512 295d26aaaebe5a259ae46486c691e8a72068e73b7f5bfa1abcd9de65947f532f27c21ec77b7d008d9dd20aac0367f5eb9bbc72c284c3ce802eecef4777527ed5
SSDEEP 1572864:rmYWQRWtJ65M7a2iu4Rywh9hJyO9N+oJOTU8f/kmgZ2sI:a4M7a2H4Ryu+dNgI
TLSH
T1D2587C03E29610D9F09DD1B59B468636DEB2BC454739A2DF2690271A2F7BFE0273DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	Nightcord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	Nightcord.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4752	Nightcord.exe
2912	Nightcord.exe
4752	Nightcord.exe
2912	Nightcord.exe
4984	Nightcord.exe
4984	Nightcord.exe
4984	Nightcord.exe
4984	Nightcord.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 4380	4632	Nightcord.exe	86
PID 4632 wrote to memory of 4752	4632	Nightcord.exe	87
PID 4632 wrote to memory of 2912	4632	Nightcord.exe	88
PID 4632 wrote to memory of 4984	4632	Nightcord.exe	100

C:\Users\Admin\AppData\Local\Temp\Nightcord.exe
"C:\Users\Admin\AppData\Local\Temp\Nightcord.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Users\Admin\AppData\Local\Temp\Nightcord.exe
  "C:\Users\Admin\AppData\Local\Temp\Nightcord.exe" --type=gpu-process --field-trial-handle=1584,13879108614598249083,4332896204723475895,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1608 /prefetch:2
  2⤵
  PID:4380
- C:\Users\Admin\AppData\Local\Temp\Nightcord.exe
  "C:\Users\Admin\AppData\Local\Temp\Nightcord.exe" --type=renderer --field-trial-handle=1584,13879108614598249083,4332896204723475895,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2144 /prefetch:1
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  PID:4752
- C:\Users\Admin\AppData\Local\Temp\Nightcord.exe
  "C:\Users\Admin\AppData\Local\Temp\Nightcord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1584,13879108614598249083,4332896204723475895,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2912
- C:\Users\Admin\AppData\Local\Temp\Nightcord.exe
  "C:\Users\Admin\AppData\Local\Temp\Nightcord.exe" --type=gpu-process --field-trial-handle=1584,13879108614598249083,4332896204723475895,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1576 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\Nightcord Installer\Network Persistent State
Size 175B
SHA256 bd367325bb3c469e1aa6dcff50b6296b9b8d5bf5bed538f01f36c29b0603511a
MD5 2b7e4377653e6e07536efe7fc1bd78a7
SHA1 cdd9c03b91e368bc14c4ac0ff7204ee698fa285d
SHA512 5dae5ba1af5ae6e52a39092bc5b4ebb454906c919735ab5b7f7a4c84a487e26376f68aee9c86265142e03c0f163cc0623094fa4f2936bff17504c2059ba112dc
TLSH
T12CC0806E56702CFF4785C3A055147917C6FE104B121C9E5DD534372D41754AD8418857
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5983ad.TMP

Path C:\Users\Admin\AppData\Roaming\Nightcord Installer\Network Persistent State~RFe5983ad.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4380-2-0x00007FF868E30000-0x00007FF868E31000-memory.dmp

Download

memory/4380-57-0x00000241EBAC0000-0x00000241EBB8D000-memory.dmp

Download