Analysis
- max time kernel
67s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
31/08/2026, 13:56
General
- Target run-nightix.exe
- Size 672KB
- Sample260831-q85f3swthy
- SHA256 afb15a15dd3793e65d81c9ab7ca794b545b2ffabe956d308f8ab17c42d3f3ef8
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Executes dropped EXE 4 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Looks up external IP address via web service 1 TTPs 10 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\run-nightix.exe"C:\Users\Admin\AppData\Local\Temp\run-nightix.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bnd_74537792\knbffgkvrjz4562t.exe"C:\Users\Admin\AppData\Local\Temp\bnd_74537792\knbffgkvrjz4562t.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="{ZV\2~<"2VU72j" dir=in action=allow program="C:\Windows\_Microsoft67" enable=yes & exit3⤵
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\_Microsoft67" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\_Microsoft67" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\_Microsoft67" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\_Microsoft67" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\_Microsoft67" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\_Microsoft67" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\_Microsoft67" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 1 /tn "" /tr "C:\Windows\_Microsoft67" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\bnd_74537792\run-nightix.bat" "2⤵
- Executes a command shell one-liner
-
-
C:\Windows\_Microsoft67"C:\Windows\_Microsoft67"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\_Microsoft67"C:\Windows\_Microsoft67"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\_Microsoft67"C:\Windows\_Microsoft67"1⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
C:\Windows\_Microsoft67"C:\Windows\_Microsoft67"1⤵
-
C:\Windows\_Microsoft67"C:\Windows\_Microsoft67"1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
knbffgkvrjz4562t.exe
run-nightix.bat
memory/1184-100-0x0000024AF61B0000-0x0000024AF62A0000-memory.dmp
memory/2708-103-0x0000015900020000-0x0000015900110000-memory.dmp
memory/2708-101-0x0000015900020000-0x0000015900110000-memory.dmp
memory/2708-97-0x0000015900210000-0x000001590023E000-memory.dmp
memory/3012-0-0x00007FF8EA99F000-0x00007FF8EA9A0000-memory.dmp
memory/3012-1-0x00000000006B0000-0x000000000075E000-memory.dmp
memory/3012-4-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
memory/3012-5-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
memory/3012-26-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
memory/3840-24-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
memory/3840-45-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
memory/3840-27-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
memory/3840-22-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
memory/3840-25-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
memory/3840-28-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
memory/3840-44-0x00000193F57F0000-0x00000193F58E0000-memory.dmp
memory/3840-23-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
memory/3840-94-0x00000193F57F0000-0x00000193F58E0000-memory.dmp
memory/3840-95-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
memory/3840-13-0x00000193F3110000-0x00000193F31B8000-memory.dmp
memory/3840-20-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
memory/3840-19-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
memory/3840-18-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp
memory/4796-96-0x00000295442A0000-0x0000029544390000-memory.dmp