Analysis

  • max time kernel
    0s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    27-12-2023 03:28

General

  • Target

    a0e87c4b9483fae95f6f57946023d3e7.exe

  • Size

    2.8MB

  • MD5

    a0e87c4b9483fae95f6f57946023d3e7

  • SHA1

    993ab6ddf0f3dfa349ef7ad4e3a44d0fc2a15a0a

  • SHA256

    bb7dead4d3da28e16ef45d0019cd42bbd3c4e3454c3042867e7f64aee2439912

  • SHA512

    95979bbfb68d50223fa05e35a7fa6552a30889a07327347d8a6d03a80fc8d92bbcd4f7456431aceb7fc43acc784610d196e2d002baee9278c762e45852ee69b1

  • SSDEEP

    49152:EgGeCFEEIxWoH57jp49GfCZHw7DhSZ2eGIxy2FKVqrZix9zSlbtcUw5:JHCG+0Zja9sCZzZnGWdF+wZixpebeU8

Malware Config

Extracted

Family

nullmixer

C2

http://watira.xyz/

Extracted

Family

vidar

Version

39.7

Botnet

706

C2

https://shpak125.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family

smokeloader

Botnet

pub5

Extracted

Family

smokeloader

Version

2020

C2

http://conceitosseg.com/upload/

http://integrasidata.com/upload/

http://ozentekstil.com/upload/

http://finbelportal.com/upload/

http://telanganadigital.com/upload/

rc4.i32
rc4.i32

Signatures

  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar Stealer 5 IoCs
  • ASPack v2.12-2.42 2 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a0e87c4b9483fae95f6f57946023d3e7.exe
    "C:\Users\Admin\AppData\Local\Temp\a0e87c4b9483fae95f6f57946023d3e7.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2104
    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2396
  • C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sahiba_5.exe
    1⤵
      PID:1704
      • C:\Users\Admin\AppData\Local\Temp\7zSC5997A26\sahiba_5.exe
        sahiba_5.exe
        2⤵
          PID:1984
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c cmd < Compatto.rtf
        1⤵
          PID:2864
          • C:\Windows\SysWOW64\cmd.exe
            cmd
            2⤵
              PID:488
              • C:\Windows\SysWOW64\findstr.exe
                findstr /V /R "^jvMDwkwydQdmnxGPmMOjYlbIlopECWXOZojRKCmISYgoKPYfXOyLKoMeYraSevCxTCAdoOyWjyxqVfYxlTHNQkrRvpTHpGGccUgofIipJpnFNMuJyYIpPPDHnITYVnMGn$" Oggi.rtf
                3⤵
                  PID:1056
                • C:\Windows\SysWOW64\PING.EXE
                  ping 127.0.0.1 -n 30
                  3⤵
                  • Runs ping.exe
                  PID:1088
                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Triste.exe.com
                  Triste.exe.com n
                  3⤵
                    PID:308
                    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Triste.exe.com
                      C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Triste.exe.com n
                      4⤵
                        PID:1304
                        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
                          C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
                          5⤵
                            PID:2484
                  • C:\Users\Admin\AppData\Local\Temp\7zSC5997A26\sahiba_7.exe
                    sahiba_7.exe
                    1⤵
                      PID:1628
                    • C:\Users\Admin\AppData\Local\Temp\7zSC5997A26\sahiba_3.exe
                      sahiba_3.exe
                      1⤵
                        PID:1436
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 964
                          2⤵
                          • Program crash
                          PID:2904
                      • C:\Users\Admin\AppData\Local\Temp\7zSC5997A26\sahiba_1.exe
                        "C:\Users\Admin\AppData\Local\Temp\7zSC5997A26\sahiba_1.exe" -a
                        1⤵
                          PID:2000
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 416
                          1⤵
                          • Program crash
                          PID:952
                        • C:\Users\Admin\AppData\Local\Temp\7zSC5997A26\sahiba_8.exe
                          sahiba_8.exe
                          1⤵
                            PID:1028
                          • C:\Users\Admin\AppData\Local\Temp\7zSC5997A26\sahiba_6.exe
                            sahiba_6.exe
                            1⤵
                              PID:2928
                            • C:\Users\Admin\AppData\Local\Temp\7zSC5997A26\sahiba_4.exe
                              sahiba_4.exe
                              1⤵
                                PID:1820
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c sahiba_8.exe
                                1⤵
                                  PID:2124
                                • C:\Users\Admin\AppData\Local\Temp\7zSC5997A26\sahiba_2.exe
                                  sahiba_2.exe
                                  1⤵
                                    PID:2896
                                  • C:\Users\Admin\AppData\Local\Temp\7zSC5997A26\sahiba_1.exe
                                    sahiba_1.exe
                                    1⤵
                                      PID:2780
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c sahiba_7.exe
                                      1⤵
                                        PID:2668
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c sahiba_6.exe
                                        1⤵
                                          PID:1416
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c sahiba_4.exe
                                          1⤵
                                            PID:2572
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c sahiba_3.exe
                                            1⤵
                                              PID:288
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c sahiba_2.exe
                                              1⤵
                                                PID:796
                                              • C:\Windows\SysWOW64\cmd.exe
                                                C:\Windows\system32\cmd.exe /c sahiba_1.exe
                                                1⤵
                                                  PID:500
                                                • C:\Users\Admin\AppData\Local\Temp\7zSC5997A26\setup_install.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\7zSC5997A26\setup_install.exe"
                                                  1⤵
                                                    PID:2716

                                                  Network

                                                  MITRE ATT&CK Enterprise v15

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe

                                                    Filesize

                                                    382KB

                                                    MD5

                                                    1aa73f76e15a9a8c7255cb9611b4b2ca

                                                    SHA1

                                                    7718f384523ddb84ac52eead8c3b14f5f80aa6d6

                                                    SHA256

                                                    4c97ce65c393e5c917cf8704d9b35e0e034a75e5a7baa8326c534a7bedba04fe

                                                    SHA512

                                                    f582003e4af18edca96ce2e4b6fae9187c245586dc1782e2af1ec1ebffc4e222a5b11627270dc8c57102d6e489f3bacd299caaa2cfe3c05ec26583bbddef398d

                                                  • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe

                                                    Filesize

                                                    93KB

                                                    MD5

                                                    9b44481728f8fd6894874cf9171e81f1

                                                    SHA1

                                                    e36f10ea66dbf472629b73ed98595a850c9045a8

                                                    SHA256

                                                    d56b2405d390856b7641ad6777e8cfb7722757547e41407ecbd54ca32c047ada

                                                    SHA512

                                                    cd6c7f72637c29c2da1292d45baf8438bb10429f6730e483e78da5f7572639f6018076081b709e0547c16571374385e7c13261bce5d2b92c6e864a38f816c7c5

                                                  • \Users\Admin\AppData\Local\Temp\7zSC5997A26\setup_install.exe

                                                    Filesize

                                                    287KB

                                                    MD5

                                                    2374477610c8c4f47a83a5ba028abb59

                                                    SHA1

                                                    ac155fea47dfaa9f6e8a8e8f20c9b5442e0683b9

                                                    SHA256

                                                    5fa7c251a656ab30e3814be14132bfa4a7320c405d6b632f24240b91e6ecb8ea

                                                    SHA512

                                                    ee38567e57f7ada3117831ee416a2bc6395cf75032f0592ffe29db246a73d144b4c1419bb666d8e1950d0e0a79236dbc2c2e2109bca8d3f15496498934dea990

                                                  • \Users\Admin\AppData\Local\Temp\7zSC5997A26\setup_install.exe

                                                    Filesize

                                                    92KB

                                                    MD5

                                                    974260c778328260996faa74824f1cef

                                                    SHA1

                                                    ed5aab39b5e9f3c3f70054d2bbbce74570a92c91

                                                    SHA256

                                                    a0e68d77cbc879c51b341c087507fdf4762a9a1071632f9cf6fd4f77ceae6262

                                                    SHA512

                                                    065540d192593af6eb21eb43ce1d13309c8a11623be0843525294836b0227a74e443585eb0214a918cb1587309e1f8eaaa311227493e3d29f5920bc56e80cee8

                                                  • \Users\Admin\AppData\Local\Temp\setup_installer.exe

                                                    Filesize

                                                    1.4MB

                                                    MD5

                                                    3fccbfccf160a096f24e2aec7ca8e815

                                                    SHA1

                                                    3db913dfc6184f8f62b3053f6d2f55eb903bc7a0

                                                    SHA256

                                                    9d8c7d28012ce58e8cc85c0763f45e05471fc69ca4a98955b7a70a3e0589a352

                                                    SHA512

                                                    3e3557b5f65a24cda49031b66cf0cec4ed419d4301963f3f7f78755228e0efa3d75635e07ed23e33e071e16318ad95457823f65ff07df42726134233207f2823

                                                  • \Users\Admin\AppData\Local\Temp\setup_installer.exe

                                                    Filesize

                                                    92KB

                                                    MD5

                                                    d772d6902200f5d4599a9b27d0d8f9e6

                                                    SHA1

                                                    564eefb3fabe655b2fb51f492959b158cb20e12d

                                                    SHA256

                                                    7bf11639663306b53a7fe0e3826d12f03e1dda7b1fb3abaa758e3281d35f8e17

                                                    SHA512

                                                    6682d79a013129aceba9cde75a82f0444a28d30bfbd1c4656d7e3774b469283027a780362657c908c991f9b5939db32792e6713a323667ab763a95b3f3e23d36

                                                  • \Users\Admin\AppData\Local\Temp\setup_installer.exe

                                                    MD5

                                                    d41d8cd98f00b204e9800998ecf8427e

                                                    SHA1

                                                    da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                    SHA256

                                                    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                    SHA512

                                                    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                  • memory/1184-238-0x0000000002610000-0x0000000002625000-memory.dmp

                                                    Filesize

                                                    84KB

                                                  • memory/1436-301-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                    Filesize

                                                    768KB

                                                  • memory/1436-371-0x0000000000920000-0x0000000000A20000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                  • memory/1436-155-0x0000000000920000-0x0000000000A20000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                  • memory/1436-156-0x00000000021F0000-0x000000000228D000-memory.dmp

                                                    Filesize

                                                    628KB

                                                  • memory/1436-157-0x0000000000400000-0x00000000004C0000-memory.dmp

                                                    Filesize

                                                    768KB

                                                  • memory/1820-366-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

                                                    Filesize

                                                    9.9MB

                                                  • memory/1820-150-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

                                                    Filesize

                                                    9.9MB

                                                  • memory/1820-154-0x000000001B200000-0x000000001B280000-memory.dmp

                                                    Filesize

                                                    512KB

                                                  • memory/1820-130-0x0000000000E60000-0x0000000000E68000-memory.dmp

                                                    Filesize

                                                    32KB

                                                  • memory/1820-370-0x000000001B200000-0x000000001B280000-memory.dmp

                                                    Filesize

                                                    512KB

                                                  • memory/1984-151-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

                                                    Filesize

                                                    9.9MB

                                                  • memory/1984-158-0x000000001AE10000-0x000000001AE90000-memory.dmp

                                                    Filesize

                                                    512KB

                                                  • memory/1984-149-0x00000000002D0000-0x00000000002EE000-memory.dmp

                                                    Filesize

                                                    120KB

                                                  • memory/1984-132-0x0000000000C20000-0x0000000000C46000-memory.dmp

                                                    Filesize

                                                    152KB

                                                  • memory/1984-334-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

                                                    Filesize

                                                    9.9MB

                                                  • memory/2396-50-0x0000000002F40000-0x000000000305E000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                  • memory/2484-335-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                                    Filesize

                                                    4KB

                                                  • memory/2484-305-0x0000000000090000-0x0000000000098000-memory.dmp

                                                    Filesize

                                                    32KB

                                                  • memory/2484-341-0x0000000000090000-0x0000000000098000-memory.dmp

                                                    Filesize

                                                    32KB

                                                  • memory/2484-339-0x0000000000090000-0x0000000000098000-memory.dmp

                                                    Filesize

                                                    32KB

                                                  • memory/2484-336-0x0000000000090000-0x0000000000098000-memory.dmp

                                                    Filesize

                                                    32KB

                                                  • memory/2716-77-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                  • memory/2716-87-0x0000000000400000-0x000000000051E000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                  • memory/2716-76-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                  • memory/2716-73-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                  • memory/2716-70-0x0000000064940000-0x0000000064959000-memory.dmp

                                                    Filesize

                                                    100KB

                                                  • memory/2716-69-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                    Filesize

                                                    572KB

                                                  • memory/2716-63-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                    Filesize

                                                    152KB

                                                  • memory/2716-61-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                    Filesize

                                                    572KB

                                                  • memory/2716-58-0x0000000000400000-0x000000000051E000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                  • memory/2716-79-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                    Filesize

                                                    152KB

                                                  • memory/2716-80-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                    Filesize

                                                    152KB

                                                  • memory/2716-82-0x0000000000400000-0x000000000051E000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                  • memory/2716-83-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                    Filesize

                                                    152KB

                                                  • memory/2716-86-0x0000000000400000-0x000000000051E000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                  • memory/2716-68-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                    Filesize

                                                    572KB

                                                  • memory/2716-78-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                  • memory/2716-300-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                  • memory/2716-299-0x000000006EB40000-0x000000006EB63000-memory.dmp

                                                    Filesize

                                                    140KB

                                                  • memory/2716-298-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                    Filesize

                                                    572KB

                                                  • memory/2716-297-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                    Filesize

                                                    152KB

                                                  • memory/2716-296-0x0000000064940000-0x0000000064959000-memory.dmp

                                                    Filesize

                                                    100KB

                                                  • memory/2716-295-0x0000000000400000-0x000000000051E000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                  • memory/2716-88-0x0000000000400000-0x000000000051E000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                  • memory/2716-72-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                    Filesize

                                                    572KB

                                                  • memory/2716-74-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                  • memory/2716-81-0x0000000000400000-0x000000000051E000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                  • memory/2716-85-0x0000000000400000-0x000000000051E000-memory.dmp

                                                    Filesize

                                                    1.1MB

                                                  • memory/2896-159-0x00000000004E0000-0x00000000005E0000-memory.dmp

                                                    Filesize

                                                    1024KB

                                                  • memory/2896-153-0x0000000000400000-0x000000000046B000-memory.dmp

                                                    Filesize

                                                    428KB

                                                  • memory/2896-152-0x00000000002D0000-0x00000000002D9000-memory.dmp

                                                    Filesize

                                                    36KB

                                                  • memory/2896-239-0x0000000000400000-0x000000000046B000-memory.dmp

                                                    Filesize

                                                    428KB