ecf3d3b121abae2d915158a74508807e3696cdeaf7a3bb592372c730a764020c

General

Target
tmpb8h_8u8c.exe
Size 8.2MB
Sample260702-pa6e2sf14j
SHA256 ecf3d3b121abae2d915158a74508807e3696cdeaf7a3bb592372c730a764020c
MD5 e459341d05157f71a10b3ef4f552cc61
SHA1 584bdd2aee046a6c09aa1fc0b410fdf25562e3a2
SHA512 9fbd31b58c4baeb43997db2f25e73b603705ec184cfebb3c6a064dfe40bece1edb8c53b66a947a9d0e08862ab325da3a223e4a4a7538dea1209d156b9d86019e
SSDEEP 196608:bR70yAyMG3c+l3fHZZRo0XJysyVhujffEdHa8qjH:byOM+VPZZRPksyfuzEpa/jH
TLSH
T1B58633A6A8DF0B19ED79EDB737B173DC99B4B01D13506C1F42A9B47631B201D2CA4A23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Loads dropped DLL 3 IoCs

pid	Process
3636	tmpb8h_8u8c.exe
3636	tmpb8h_8u8c.exe
3636	tmpb8h_8u8c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpb8h_8u8c.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\NightLight	tmpb8h_8u8c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\NightLight\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\NightLight Desktop\\NightLight Desktop.exe"	tmpb8h_8u8c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\NightLight\ = "URL:NightLight Protocol"	tmpb8h_8u8c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\NightLight\URL Protocol	tmpb8h_8u8c.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\NightLight\DefaultIcon	tmpb8h_8u8c.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\NightLight\shell	tmpb8h_8u8c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\NightLight\shell\ = "open"	tmpb8h_8u8c.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\NightLight\shell\open\command	tmpb8h_8u8c.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\NightLight\shell\open	tmpb8h_8u8c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\NightLight\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\NightLight Desktop\\NightLight Desktop.exe\" -url \"%1\""	tmpb8h_8u8c.exe

C:\Users\Admin\AppData\Local\Temp\tmpb8h_8u8c.exe
"C:\Users\Admin\AppData\Local\Temp\tmpb8h_8u8c.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NightLight Desktop.exe

Path C:\Users\Admin\AppData\Local\Programs\NightLight Desktop\NightLight Desktop.exe
Size 15.6MB
SHA256 97f51bdc2aec13ae5345189987b294d7a586143e984688de773c373f4267a2c0
MD5 5ca3ae3f560199b7d1eacb5e884eb1e8
SHA1 32077f6d4e9c3a197707a5c67a54cf9fd6de9f69
SHA512 8d91bd47b2248fd90e24339a1a688b2129c532343a869397b3223214d73aebf53bbdb2820c30771dcea51cdf246a8eb9ae9feeb908a8c83cc951d86ce1a9fba3
SSDEEP 98304:wfpFhsWph2MN7LivZbUqhXiw4fOU7baBzjYz0ILiVk2rby4hFz3DyWSX3Ek93rtv:yt7pEkiRbUsifflakkyW3DCxdC+b
TLSH
T101F66B07F96500E8C4AEC674C53662137F717C494B2027D72AA4F6282FB7BE0ADBA754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz5C35.tmp\InstallOptions.dll
Size 15KB
SHA256 dd0d1a8c4511261333e90a94d9912000592c46731b615aa7a37cd2b3eb6a8d58
MD5 7854290f8bc473fb9fad1917b0065731
SHA1 27c0e4731e395dfe612d954bf8793c533c53ef8f
SHA512 736030a5e1b744d0f96745f9933a57f5b52361288d33aeeaad12e054c47c4bb705cfc7d5cd4a5e3e667a6c6252e1c2a573b2707241d7b73b60c73daf2de52038
SSDEEP 192:EJGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoT2g11929WtshLAzgSrX8:EJNt+4t7uJalUnGesY7Lt8nC3/Yosa
TLSH
T1E9624D1137D598B3E2E62A797EF373138FA5FB22A4428E0BC7332E0638565805D78311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsz5C35.tmp\System.dll
Size 12KB
SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
MD5 6d08f0d5503bb100b8429fefaad163a6
SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
TLSH
T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsz5C35.tmp\ioSpecial.ini
Size 1KB
SHA256 71624b3e5e5c1c6d2f6234ed827fddb81271e8dd5244bc2e2a25b3a78f4b9a59
MD5 a5788239c117ed8cd87558c563193e4c
SHA1 b117fb7d027325d8c9587e0370e8ca658cfcb52e
SHA512 63596364525b1495a25db1864c46d5d461b433a3f175e5545f6516aeb7bd6dd976ed08398c392ec5022bf70ddee176c20b0c410fb38a7261eb5bdfb504c879a9
TLSH
T103115E033DF95518E2BAFB08EFF5407997397852582DD90E95D10A0F48E9A808923BFF
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsz5C35.tmp\ioSpecial.ini
Size 1KB
SHA256 815dbfd70d8576f7a8c2431cc0defa70d5af73b532d27dacb004510bd52196d4
MD5 d669fefea6170475542503e5a9e3f2a9
SHA1 4b63b0cf67bd1019a5a585753e48bbbb1072fb5a
SHA512 2a456c360c84b2cd63bd2bc27098ddca8328e36206e4cd5138df1976260f25b1701a32e5c3f9fb2206492b983568072886829fbff1b5af82f4f3c13e5a402753
TLSH
T16421B0037AFC1618F2FABB14FFB541749B3A7856A839C60D41D1090E09E5B808963BBB
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads