Analysis

  • max time kernel
    0s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-12-2023 13:16

General

  • Target

    718b5089505fed92d1a44dc0dbeb36dc.exe

  • Size

    2.8MB

  • MD5

    718b5089505fed92d1a44dc0dbeb36dc

  • SHA1

    f4afe14c1b392514350f4495c44f998d3f19128f

  • SHA256

    df872b0b7c336241db1a1ff9e83100d6ffb2b898a46c0c7b37a47dcbd002b056

  • SHA512

    4c9d292125343b5b7edfe0051454fff957c040fd822e9b9d32f6a94d654dae778ca6fcb1e269adcb83363b3ade2893ae2ae63558f2906185ed67298c841bc807

  • SSDEEP

    49152:xcBszOxu3gCpbwOXh+1b4yFjErlsV6SP5iWyZ9KFFdZyZmj9MJ0yEwJ84vLRaBtf:xSizpbwOxKb4y8sVwWyZ0aZw9zCvLUBN

Malware Config

Extracted

Family

nullmixer

C2

http://watira.xyz/

Extracted

Family

vidar

Version

39.7

Botnet

706

C2

https://shpak125.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family

smokeloader

Botnet

pub5

Signatures

  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar Stealer 5 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs ping.exe 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\718b5089505fed92d1a44dc0dbeb36dc.exe
    "C:\Users\Admin\AppData\Local\Temp\718b5089505fed92d1a44dc0dbeb36dc.exe"
    1⤵
      PID:2496
      • C:\Users\Admin\AppData\Local\Temp\7zS0C988377\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS0C988377\setup_install.exe"
        2⤵
          PID:4760
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c sonia_7.exe
            3⤵
              PID:3236
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c sonia_6.exe
              3⤵
                PID:3660
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c sonia_5.exe
                3⤵
                  PID:4060
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c sonia_4.exe
                  3⤵
                    PID:3340
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c sonia_3.exe
                    3⤵
                      PID:3112
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c sonia_2.exe
                      3⤵
                        PID:3692
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c sonia_1.exe
                        3⤵
                          PID:1608
                    • C:\Users\Admin\AppData\Local\Temp\7zS0C988377\sonia_3.exe
                      sonia_3.exe
                      1⤵
                        PID:1088
                      • C:\Users\Admin\AppData\Local\Temp\7zS0C988377\sonia_5.exe
                        sonia_5.exe
                        1⤵
                          PID:4884
                        • C:\Users\Admin\AppData\Local\Temp\7zS0C988377\sonia_1.exe
                          sonia_1.exe
                          1⤵
                            PID:1920
                            • C:\Users\Admin\AppData\Local\Temp\7zS0C988377\sonia_1.exe
                              "C:\Users\Admin\AppData\Local\Temp\7zS0C988377\sonia_1.exe" -a
                              2⤵
                                PID:4664
                            • C:\Users\Admin\AppData\Local\Temp\7zS0C988377\sonia_6.exe
                              sonia_6.exe
                              1⤵
                                PID:2932
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c cmd < Compatto.rtf
                                  2⤵
                                    PID:3828
                                    • C:\Windows\SysWOW64\cmd.exe
                                      cmd
                                      3⤵
                                        PID:2880
                                  • C:\Users\Admin\AppData\Local\Temp\7zS0C988377\sonia_7.exe
                                    sonia_7.exe
                                    1⤵
                                      PID:5028
                                    • C:\Windows\SysWOW64\PING.EXE
                                      ping 127.0.0.1 -n 30
                                      1⤵
                                      • Runs ping.exe
                                      PID:2608
                                    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Triste.exe.com
                                      C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Triste.exe.com n
                                      1⤵
                                        PID:2472
                                      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Triste.exe.com
                                        Triste.exe.com n
                                        1⤵
                                          PID:3884
                                        • C:\Windows\SysWOW64\findstr.exe
                                          findstr /V /R "^jvMDwkwydQdmnxGPmMOjYlbIlopECWXOZojRKCmISYgoKPYfXOyLKoMeYraSevCxTCAdoOyWjyxqVfYxlTHNQkrRvpTHpGGccUgofIipJpnFNMuJyYIpPPDHnITYVnMGn$" Oggi.rtf
                                          1⤵
                                            PID:4812
                                          • C:\Users\Admin\AppData\Local\Temp\7zS0C988377\sonia_4.exe
                                            sonia_4.exe
                                            1⤵
                                              PID:3512
                                            • C:\Users\Admin\AppData\Local\Temp\7zS0C988377\sonia_2.exe
                                              sonia_2.exe
                                              1⤵
                                                PID:740
                                              • C:\Windows\system32\dwm.exe
                                                "dwm.exe"
                                                1⤵
                                                  PID:5116
                                                • C:\Windows\system32\dwm.exe
                                                  "dwm.exe"
                                                  1⤵
                                                    PID:4992

                                                  Network

                                                  MITRE ATT&CK Enterprise v15

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • memory/740-96-0x0000000000530000-0x0000000000630000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                  • memory/740-97-0x00000000004B0000-0x00000000004B9000-memory.dmp

                                                    Filesize

                                                    36KB

                                                  • memory/740-98-0x0000000000400000-0x000000000046C000-memory.dmp

                                                    Filesize

                                                    432KB

                                                  • memory/740-123-0x0000000000400000-0x0000000000409000-memory.dmp

                                                    Filesize

                                                    36KB

                                                  • memory/1088-100-0x0000000000650000-0x0000000000750000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                  • memory/1088-101-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                    Filesize

                                                    768KB

                                                  • memory/1088-99-0x0000000002170000-0x000000000220D000-memory.dmp

                                                    Filesize

                                                    628KB

                                                  • memory/1088-130-0x0000000002170000-0x000000000220D000-memory.dmp

                                                    Filesize

                                                    628KB

                                                  • memory/1088-129-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                    Filesize

                                                    768KB

                                                  • memory/3512-81-0x0000000002A20000-0x0000000002A3E000-memory.dmp

                                                    Filesize

                                                    120KB

                                                  • memory/3512-86-0x0000000002A40000-0x0000000002A50000-memory.dmp

                                                    Filesize

                                                    64KB

                                                  • memory/3512-78-0x0000000000A90000-0x0000000000AB6000-memory.dmp

                                                    Filesize

                                                    152KB

                                                  • memory/3512-80-0x00007FFB0D440000-0x00007FFB0DF01000-memory.dmp

                                                    Filesize

                                                    10.8MB

                                                  • memory/3512-116-0x00007FFB0D440000-0x00007FFB0DF01000-memory.dmp

                                                    Filesize

                                                    10.8MB

                                                  • memory/4760-54-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                  • memory/4760-48-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                    Filesize

                                                    572KB

                                                  • memory/4760-59-0x0000000000400000-0x000000000051D000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                  • memory/4760-58-0x0000000000400000-0x000000000051D000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                  • memory/4760-57-0x0000000000400000-0x000000000051D000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                  • memory/4760-56-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                    Filesize

                                                    152KB

                                                  • memory/4760-45-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                    Filesize

                                                    572KB

                                                  • memory/4760-61-0x0000000000400000-0x000000000051D000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                  • memory/4760-52-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                  • memory/4760-53-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                  • memory/4760-51-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                  • memory/4760-49-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                    Filesize

                                                    572KB

                                                  • memory/4760-50-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                  • memory/4760-60-0x0000000000400000-0x000000000051D000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                  • memory/4760-46-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                    Filesize

                                                    572KB

                                                  • memory/4760-39-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                    Filesize

                                                    152KB

                                                  • memory/4760-32-0x0000000000400000-0x000000000051D000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                  • memory/4760-62-0x0000000000400000-0x000000000051D000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                  • memory/4760-124-0x0000000064940000-0x0000000064959000-memory.dmp

                                                    Filesize

                                                    100KB

                                                  • memory/4760-55-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                    Filesize

                                                    152KB

                                                  • memory/4760-47-0x0000000064940000-0x0000000064959000-memory.dmp

                                                    Filesize

                                                    100KB

                                                  • memory/4760-128-0x000000006EB40000-0x000000006EB63000-memory.dmp

                                                    Filesize

                                                    140KB

                                                  • memory/4760-126-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                    Filesize

                                                    152KB

                                                  • memory/4760-132-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                    Filesize

                                                    572KB

                                                  • memory/4760-138-0x0000000000400000-0x000000000051D000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                  • memory/4760-139-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                    Filesize

                                                    1.5MB