Analysis
-
max time kernel
0s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
28-12-2023 03:33
General
-
Target
c061f6c696cde2214e0425839ae84f84.exe
-
Size
2.6MB
-
MD5
c061f6c696cde2214e0425839ae84f84
-
SHA1
907c23a4e0aed6b887e0f7c8b16e1b4f82d1f340
-
SHA256
d520edc59c5aee94806782d012efa7e0f905e90ce4e177f14cd612e7b8bb17ba
-
SHA512
c0dc8dc9e5569d0db1ac6c9ac084599111f16b60cf39c230c791327304c5452df6036dbc9f0564c05a283ba369cefb87daad3714029caa4a021b94e6d88eabd6
-
SSDEEP
49152:xcBxPkZVi7iKiF8cUvFyP2jckAjxt3htaPkvAesMMOZEwJ84vLRaBtIl9mT+Pep:xRri7ixZUvFyPScjVt4j/hCvLUBsKv
Malware Config
Extracted
nullmixer
http://razino.xyz/
Extracted
vidar
39.7
933
https://shpak125.tumblr.com/
-
profile_id
933
Extracted
smokeloader
pub5
Extracted
smokeloader
2020
http://conceitosseg.com/upload/
http://integrasidata.com/upload/
http://ozentekstil.com/upload/
http://finbelportal.com/upload/
http://telanganadigital.com/upload/
Signatures
-
NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Vidar Stealer 3 IoCs
-
ASPack v2.12-2.42 3 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 11 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c061f6c696cde2214e0425839ae84f84.exe"C:\Users\Admin\AppData\Local\Temp\c061f6c696cde2214e0425839ae84f84.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC188E806\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSC188E806\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC188E806\sahiba_2.exesahiba_2.exe1⤵
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 4081⤵
- Program crash
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
-
C:\Users\Admin\AppData\Local\Temp\7zSC188E806\sahiba_1.exe"C:\Users\Admin\AppData\Local\Temp\7zSC188E806\sahiba_1.exe" -a1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSC188E806\sahiba_3.exesahiba_3.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSC188E806\sahiba_6.exesahiba_6.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSC188E806\sahiba_1.exesahiba_1.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSC188E806\sahiba_7.exesahiba_7.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSC188E806\sahiba_5.exesahiba_5.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSC188E806\sahiba_4.exesahiba_4.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_7.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_6.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_5.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_4.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_3.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_2.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_1.exe1⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {7A22808D-3600-4194-B26D-87D15D140B27} S-1-5-21-3818056530-936619650-3554021955-1000:SFVRQGEO\Admin:Interactive:[1]1⤵
-
C:\Users\Admin\AppData\Roaming\jujrbhwC:\Users\Admin\AppData\Roaming\jujrbhw2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
Filesize
287KB
MD58e316ec3b4d715862e31529b7c155aee
SHA11e1e1268bb609d92b3e778cecbdae4e97c1b5bb2
SHA256ef5fbfafa5b4b138302c45631c72e699dd8ab43d93a77a19ba5a7b155a55d794
SHA5123e0085b92a3d2105a6f5c5618701daf0341b34f37c9ec37fc13d3093694494536c1af1e7e66e45a6a0edd7fd2d34b720fd16c1cf6a976aa3b6a4939b0f291acc
-
Filesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
Filesize
512KB
-
Filesize
32KB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
36KB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
1024KB
-
Filesize
452KB
-
Filesize
304KB
-
Filesize
452KB
-
Filesize
452KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
452KB
-
Filesize
304KB
-
Filesize
84KB
-
Filesize
628KB
-
Filesize
5.0MB
-
Filesize
1024KB
-
Filesize
5.0MB
-
Filesize
1024KB
-
Filesize
24KB
-
Filesize
144KB
-
Filesize
9.9MB
-
Filesize
24KB
-
Filesize
512KB
-
Filesize
192KB
-
Filesize
9.9MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1024KB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
372KB
-
Filesize
1.0MB
-
Filesize
572KB
-
Filesize
1.1MB
-
Filesize
572KB
-
Filesize
572KB
-
Filesize
572KB
-
Filesize
1.5MB
-
Filesize
100KB
-
Filesize
1.1MB
-
Filesize
1.5MB
-
Filesize
152KB
-
Filesize
572KB
-
Filesize
1.5MB
-
Filesize
1.1MB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
1.1MB
-
Filesize
152KB
-
Filesize
1.1MB
-
Filesize
1.5MB
-
Filesize
140KB
-
Filesize
572KB
-
Filesize
100KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB