Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
06-06-2024 12:57
Behavioral task
behavioral1
Sample
NLHyrbid/NLHybrid.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
NLHyrbid/NLHybrid.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
runme.pyc
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
runme.pyc
Resource
win10v2004-20240508-en
General
-
Target
NLHyrbid/NLHybrid.exe
-
Size
15.6MB
-
MD5
77c209dfb7b2022d18c6222c0e323621
-
SHA1
c64c3670bf1d43e6148497e53fa113596104b5e0
-
SHA256
39c8291e67e46d2187eebeff36fba793f42b5502a7f29088367e15fd50bae5eb
-
SHA512
be2bfdd58064ba432a2e9596c810f988399974393f7a4b44428dd42ba08f209e474d3d12fc3e21850ede3c43db64e56129ce279b71f4d13a8aa1844e69d02d53
-
SSDEEP
393216:wo9DM45CtT5L1V8dkurEUWj+rMvE9PKSWuK+:99NM9RndbmMvpStK+
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
NLHybrid.exepid process 2240 NLHybrid.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI19282\python312.dll upx -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
NLHybrid.exedescription pid process target process PID 1928 wrote to memory of 2240 1928 NLHybrid.exe NLHybrid.exe PID 1928 wrote to memory of 2240 1928 NLHybrid.exe NLHybrid.exe PID 1928 wrote to memory of 2240 1928 NLHybrid.exe NLHybrid.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NLHyrbid\NLHybrid.exe"C:\Users\Admin\AppData\Local\Temp\NLHyrbid\NLHybrid.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\NLHyrbid\NLHybrid.exe"C:\Users\Admin\AppData\Local\Temp\NLHyrbid\NLHybrid.exe"2⤵
- Loads dropped DLL
PID:2240
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5fb8bedf8440eb432c9f3587b8114abc0
SHA1136bb4dd38a7f6cb3e2613910607131c97674f7c
SHA256cb627a3c89de8e114c95bda70e9e75c73310eb8af6cf3a937b1e3678c8f525b6
SHA512b632235d5f60370efa23f8c50170a8ac569ba3705ec3d515efcad14009e0641649ab0f2139f06868024d929defffffefb352bd2516e8cd084e11557b31e95a63