ecf3d3b121abae2d915158a74508807e3696cdeaf7a3bb592372c730a764020c

General

Target
tmpb8h_8u8c.exe
Size 8.2MB
Sample260702-pa6e2sf14j
SHA256 ecf3d3b121abae2d915158a74508807e3696cdeaf7a3bb592372c730a764020c
MD5 e459341d05157f71a10b3ef4f552cc61
SHA1 584bdd2aee046a6c09aa1fc0b410fdf25562e3a2
SHA512 9fbd31b58c4baeb43997db2f25e73b603705ec184cfebb3c6a064dfe40bece1edb8c53b66a947a9d0e08862ab325da3a223e4a4a7538dea1209d156b9d86019e
SSDEEP 196608:bR70yAyMG3c+l3fHZZRo0XJysyVhujffEdHa8qjH:byOM+VPZZRPksyfuzEpa/jH
TLSH
T1B58633A6A8DF0B19ED79EDB737B173DC99B4B01D13506C1F42A9B47631B201D2CA4A23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Loads dropped DLL 3 IoCs

pid	Process
4008	tmpb8h_8u8c.exe
4008	tmpb8h_8u8c.exe
4008	tmpb8h_8u8c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpb8h_8u8c.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\NightLight\ = "URL:NightLight Protocol"	tmpb8h_8u8c.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\NightLight\shell	tmpb8h_8u8c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\NightLight\shell\ = "open"	tmpb8h_8u8c.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\NightLight\shell\open	tmpb8h_8u8c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\NightLight\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\NightLight Desktop\\NightLight Desktop.exe\" -url \"%1\""	tmpb8h_8u8c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\NightLight\URL Protocol	tmpb8h_8u8c.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\NightLight\DefaultIcon	tmpb8h_8u8c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\NightLight\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\NightLight Desktop\\NightLight Desktop.exe"	tmpb8h_8u8c.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\NightLight\shell\open\command	tmpb8h_8u8c.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\NightLight	tmpb8h_8u8c.exe

C:\Users\Admin\AppData\Local\Temp\tmpb8h_8u8c.exe
"C:\Users\Admin\AppData\Local\Temp\tmpb8h_8u8c.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NightLight Desktop.exe

Path C:\Users\Admin\AppData\Local\Programs\NightLight Desktop\NightLight Desktop.exe
Size 15.6MB
SHA256 97f51bdc2aec13ae5345189987b294d7a586143e984688de773c373f4267a2c0
MD5 5ca3ae3f560199b7d1eacb5e884eb1e8
SHA1 32077f6d4e9c3a197707a5c67a54cf9fd6de9f69
SHA512 8d91bd47b2248fd90e24339a1a688b2129c532343a869397b3223214d73aebf53bbdb2820c30771dcea51cdf246a8eb9ae9feeb908a8c83cc951d86ce1a9fba3
SSDEEP 98304:wfpFhsWph2MN7LivZbUqhXiw4fOU7baBzjYz0ILiVk2rby4hFz3DyWSX3Ek93rtv:yt7pEkiRbUsifflakkyW3DCxdC+b
TLSH
T101F66B07F96500E8C4AEC674C53662137F717C494B2027D72AA4F6282FB7BE0ADBA754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu5129.tmp\InstallOptions.dll
Size 15KB
SHA256 dd0d1a8c4511261333e90a94d9912000592c46731b615aa7a37cd2b3eb6a8d58
MD5 7854290f8bc473fb9fad1917b0065731
SHA1 27c0e4731e395dfe612d954bf8793c533c53ef8f
SHA512 736030a5e1b744d0f96745f9933a57f5b52361288d33aeeaad12e054c47c4bb705cfc7d5cd4a5e3e667a6c6252e1c2a573b2707241d7b73b60c73daf2de52038
SSDEEP 192:EJGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoT2g11929WtshLAzgSrX8:EJNt+4t7uJalUnGesY7Lt8nC3/Yosa
TLSH
T1E9624D1137D598B3E2E62A797EF373138FA5FB22A4428E0BC7332E0638565805D78311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsu5129.tmp\System.dll
Size 12KB
SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
MD5 6d08f0d5503bb100b8429fefaad163a6
SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
TLSH
T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsu5129.tmp\ioSpecial.ini
Size 794B
SHA256 553b9724720bf5fe996326bafc5968d8cbb1856bae8dbf04594fdd2f57563c4b
MD5 65006e89768cad1fb332f65a2c7e1025
SHA1 481661940ec0d56ed2e92c2218df011fcc65570c
SHA512 87a8393920e37e1b98fd4fa32e04cc9ee6e04b89e56c3203862a1d3a6acc8576c53a0b9f561478f4fad9d4ac801b0a24a4db886f0b9e688aa0d32d4f0109c3b5
TLSH
T1D2014B033DF95128E2AEF608FFF5807997397851581ED90E85E14A0F48E57808567BEF
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsu5129.tmp\ioSpecial.ini
Size 1KB
SHA256 c409297ac89020757211b1e09effcff2c4721967f2dac4e39c21495a95a4fed4
MD5 802bf39799944a144263fde862ac0705
SHA1 c19b36e227906e4f3065e67a512a84d2bf3da134
SHA512 a8f1cb52ced872ab0027e0e073d6c6d09e383bf8d382f65f4675e763aeb841924bb5144b328939c1933a9abdb75027c29dc518ab34d75ecc5555950481309115
TLSH
T14031B5037AFC1518F2FBFB14FFB441789B3A7856A839C60D51D1090E08E5A409963BAB
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsu5129.tmp\ioSpecial.ini
Size 1KB
SHA256 b6eed130e1aac766e52856e3cc566fc28c46eac17fcf129f6ef8c4ef81167aaa
MD5 82366f20b03d7d60c74539779aeb09fd
SHA1 a518be11a3d4403817c25531c320620336bc1cea
SHA512 b0f20f04064384f722cd658ab1903ab61c22ff049ee89024be9f0e5ffcce7a92e1cec814b0ccc1d09755a15ae1ac96a300661c519796ff3bad79eef3d8ca244d
TLSH
T1FA1151033DF95518E2BAFB08EBB5407997397851582DD90E95D10A0F48E5A808927BEB
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads