Malware sandboxing report by Hatching Triage

General

Target

55F22AA33B837E543E8A58408ED843E41515292DEAD43.exe
Size

2MB
Sample

221104-mkc55secf7
MD5

23b40478a61a00df0473d1f56cc4ff62
SHA1

64257c787846db476c4cd71464af58fae87b26a9
SHA256

55f22aa33b837e543e8a58408ed843e41515292dead43b57b2ae42b735c34f11
SHA512

3f861177bfafeaee6f682704b066a6c42242fb425fb79e4e43b28187d97b2c5b68717775f62962c7d169ac2de61fbec32079434b293523d95de17fd273479bf5
SSDEEP

49152:xcBIPkZVi7iKiF8cUvFyPZGf5S8wK82iXCgEwJ84vLRaBtIl9mTcNFpaEjoLQKo5:x6ri7ixZUvFyPZu4IiXC3CvLUBsKcNFZ

Score

10^/10

Malware Config

Extracted

Family

nullmixer

C2

http://sokiran.xyz/

Extracted

Family

vidar

Version

39.6

Botnet

933

C2

https://sslamlssa1.tumblr.com/

Attributes

profile_id
933

Targets

- Target
  
  55F22AA33B837E543E8A58408ED843E41515292DEAD43.exe
- Size
  
  2MB
- MD5
  
  23b40478a61a00df0473d1f56cc4ff62
- SHA1
  
  64257c787846db476c4cd71464af58fae87b26a9
- SHA256
  
  55f22aa33b837e543e8a58408ed843e41515292dead43b57b2ae42b735c34f11
- SHA512
  
  3f861177bfafeaee6f682704b066a6c42242fb425fb79e4e43b28187d97b2c5b68717775f62962c7d169ac2de61fbec32079434b293523d95de17fd273479bf5
- SSDEEP
  
  49152:xcBIPkZVi7iKiF8cUvFyPZGf5S8wK82iXCgEwJ84vLRaBtIl9mTcNFpaEjoLQKo5:x6ri7ixZUvFyPZu4IiXC3CvLUBsKcNFZ
Score

10^/10

nullmixer privateloader smokeloader vidar 933 aspackv2 backdoor dropper evasion loader stealer trojan
- Detects Smokeloader packer
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- NullMixer
  NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
  dropper nullmixer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Vidar Stealer
  stealer
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2