ecf3d3b121abae2d915158a74508807e3696cdeaf7a3bb592372c730a764020c

General

Target
tmpb8h_8u8c.exe
Size 8.2MB
Sample260702-pa6e2sf14j
SHA256 ecf3d3b121abae2d915158a74508807e3696cdeaf7a3bb592372c730a764020c
MD5 e459341d05157f71a10b3ef4f552cc61
SHA1 584bdd2aee046a6c09aa1fc0b410fdf25562e3a2
SHA512 9fbd31b58c4baeb43997db2f25e73b603705ec184cfebb3c6a064dfe40bece1edb8c53b66a947a9d0e08862ab325da3a223e4a4a7538dea1209d156b9d86019e
SSDEEP 196608:bR70yAyMG3c+l3fHZZRo0XJysyVhujffEdHa8qjH:byOM+VPZZRPksyfuzEpa/jH
TLSH
T1B58633A6A8DF0B19ED79EDB737B173DC99B4B01D13506C1F42A9B47631B201D2CA4A23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Loads dropped DLL 3 IoCs

pid	Process
2164	tmpb8h_8u8c.exe
2164	tmpb8h_8u8c.exe
2164	tmpb8h_8u8c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpb8h_8u8c.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\NightLight\shell\ = "open"	tmpb8h_8u8c.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\NightLight\shell\open	tmpb8h_8u8c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\NightLight\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\NightLight Desktop\\NightLight Desktop.exe\" -url \"%1\""	tmpb8h_8u8c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\NightLight\ = "URL:NightLight Protocol"	tmpb8h_8u8c.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\NightLight\DefaultIcon	tmpb8h_8u8c.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\NightLight\shell	tmpb8h_8u8c.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\NightLight\shell\open\command	tmpb8h_8u8c.exe
Key created	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\NightLight	tmpb8h_8u8c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\NightLight\URL Protocol	tmpb8h_8u8c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\NightLight\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\NightLight Desktop\\NightLight Desktop.exe"	tmpb8h_8u8c.exe

C:\Users\Admin\AppData\Local\Temp\tmpb8h_8u8c.exe
"C:\Users\Admin\AppData\Local\Temp\tmpb8h_8u8c.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NightLight Desktop.exe

Path C:\Users\Admin\AppData\Local\Programs\NightLight Desktop\NightLight Desktop.exe
Size 15.6MB
SHA256 97f51bdc2aec13ae5345189987b294d7a586143e984688de773c373f4267a2c0
MD5 5ca3ae3f560199b7d1eacb5e884eb1e8
SHA1 32077f6d4e9c3a197707a5c67a54cf9fd6de9f69
SHA512 8d91bd47b2248fd90e24339a1a688b2129c532343a869397b3223214d73aebf53bbdb2820c30771dcea51cdf246a8eb9ae9feeb908a8c83cc951d86ce1a9fba3
SSDEEP 98304:wfpFhsWph2MN7LivZbUqhXiw4fOU7baBzjYz0ILiVk2rby4hFz3DyWSX3Ek93rtv:yt7pEkiRbUsifflakkyW3DCxdC+b
TLSH
T101F66B07F96500E8C4AEC674C53662137F717C494B2027D72AA4F6282FB7BE0ADBA754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv53E8.tmp\InstallOptions.dll
Size 15KB
SHA256 dd0d1a8c4511261333e90a94d9912000592c46731b615aa7a37cd2b3eb6a8d58
MD5 7854290f8bc473fb9fad1917b0065731
SHA1 27c0e4731e395dfe612d954bf8793c533c53ef8f
SHA512 736030a5e1b744d0f96745f9933a57f5b52361288d33aeeaad12e054c47c4bb705cfc7d5cd4a5e3e667a6c6252e1c2a573b2707241d7b73b60c73daf2de52038
SSDEEP 192:EJGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoT2g11929WtshLAzgSrX8:EJNt+4t7uJalUnGesY7Lt8nC3/Yosa
TLSH
T1E9624D1137D598B3E2E62A797EF373138FA5FB22A4428E0BC7332E0638565805D78311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv53E8.tmp\System.dll
Size 12KB
SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
MD5 6d08f0d5503bb100b8429fefaad163a6
SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
TLSH
T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsv53E8.tmp\ioSpecial.ini
Size 1KB
SHA256 5e40c7b017b536006d99437979fcc28c40fcbc3c5981e46a90f1fb8ac905f04b
MD5 1d55e9a2cdc726df95c55043f2451617
SHA1 9c139e9d48e4a44787941291d3df103fe25f6561
SHA512 c172dce107192d9b08d2aabb742c40fcc43e2a0f595a7c1052651dce6cd387a46fa8675397f069c1e4e6536b36a508a68b8a631583ba7c980a6b3fbb1517b5e5
TLSH
T1D6319F437AFC1618F2FABB14FFB541749B3A78569C39D60D81D0090E08E5A408963BBB
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsv53E8.tmp\ioSpecial.ini
Size 1KB
SHA256 8a8a1553fb05d18ab07665f52751640f6e9d4699ad1a9f144ce989f894c3aa55
MD5 46a3480c408832ddfb4e389d052f8395
SHA1 e7359c9f14b90f6d34b6fd085667978ce76ef3d9
SHA512 787636acec0b6bda4b9780b17b4e12a286fca40719b0af48b1b129314fe38a536da143b1a1ab604f115512c995eeb548dd3c77b682a35b19dd1278f63664b9c6
TLSH
T1B01151033DFD5518F2BABB08EFB5407997397851582DD90E91D10A0F48E5A808967BEF
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads