Analysis
-
max time kernel
0s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
24-12-2023 23:16
General
-
Target
18c3494de64bc551b855afeb82d9be54.exe
-
Size
1.5MB
-
MD5
18c3494de64bc551b855afeb82d9be54
-
SHA1
707ee21b09c8e02f9dd5bea9bab5e87818f044e9
-
SHA256
0bda273b4f8642af8821d39162b6628793e36215eafc6c70169e5346f2c836d2
-
SHA512
e9c4b975e35488d653ee7eb3419d23ab8e57205e87934316abd11bb44efe07828dada603de393a9bc995df093247c60f9539b2436e456445861eb936adff7305
-
SSDEEP
24576:Eg5AsqZ9ihb4A3+g1IEQJHTmVf5RC5rPNo6QVLz9GlhLgKznDtC+TMjO3Tz4EGxE:Egad9il4pglYTmHRCnot5c7pya3P4EnT
Malware Config
Extracted
nullmixer
http://wxkeww.xyz/
Extracted
smokeloader
pub6
Extracted
smokeloader
2020
http://conceitosseg.com/upload/
http://integrasidata.com/upload/
http://ozentekstil.com/upload/
http://finbelportal.com/upload/
http://telanganadigital.com/upload/
Signatures
-
NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\18c3494de64bc551b855afeb82d9be54.exe"C:\Users\Admin\AppData\Local\Temp\18c3494de64bc551b855afeb82d9be54.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4DD9D277\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS4DD9D277\setup_install.exe"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c karotima_2.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4DD9D277\karotima_2.exekarotima_2.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3328 -s 4163⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS4DD9D277\karotima_1.exekarotima_1.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c karotima_1.exe1⤵
-
C:\ProgramData\Java Updater\go9oia1wkk7119.exe/prstb2⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 11444⤵
- Program crash
-
-
-
-
C:\ProgramData\Java Updater\go9oia1wkk7119.exe/prstb2⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 11484⤵
- Program crash
-
-
-
-
C:\ProgramData\Java Updater\go9oia1wkk7119.exe/prstb2⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 11324⤵
- Program crash
-
-
-
-
C:\ProgramData\Java Updater\go9oia1wkk7119.exe/prstb2⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 11404⤵
- Program crash
-
-
-
-
C:\ProgramData\Java Updater\go9oia1wkk7119.exe/prstb2⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 11644⤵
- Program crash
-
-
-
-
C:\ProgramData\Java Updater\go9oia1wkk7119.exe/prstb2⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 10804⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 1628 -ip 16281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 4441⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3328 -ip 33281⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 11282⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\A3A2.exeC:\Users\Admin\AppData\Local\Temp\A3A2.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\A902.exeC:\Users\Admin\AppData\Local\Temp\A902.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe"C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2052 -ip 20521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1224 -ip 12241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 4896 -ip 48961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2716 -ip 27161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 2064 -ip 20641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1652 -ip 16521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4584 -ip 45841⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
4.2MB
-
Filesize
784KB
-
Filesize
4.2MB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
4.2MB
-
Filesize
784KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
1.1MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
572KB
-
Filesize
572KB
-
Filesize
100KB
-
Filesize
572KB
-
Filesize
572KB
-
Filesize
1.1MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
140KB
-
Filesize
100KB
-
Filesize
572KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.5MB
-
Filesize
784KB
-
Filesize
4.2MB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
4.2MB
-
Filesize
8KB
-
Filesize
4.2MB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
4.2MB
-
Filesize
4KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
4.2MB
-
Filesize
784KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
4.2MB
-
Filesize
784KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
372KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
4.6MB
-
Filesize
1024KB
-
Filesize
4.6MB
-
Filesize
36KB
-
Filesize
84KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
4.2MB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
4.2MB
-
Filesize
408KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
372KB
-
Filesize
408KB
-
Filesize
52KB
-
Filesize
48KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
4KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB