Analysis
-
max time kernel
0s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
29-12-2023 20:04
Static task
static1
General
-
Target
0286f9b59396cd300da7e312acde0650.exe
-
Size
4.3MB
-
MD5
0286f9b59396cd300da7e312acde0650
-
SHA1
dd65aee16954c62a471d43ca7664d65dafa6e3e2
-
SHA256
78e623c6620f1b07f200e69f8d0127229cd3f415575e249b3539aa020c62e4d8
-
SHA512
0ba088170ef1c8a8088b459ee05ab7bda2adf68c7d98526cab13dbd7251032347a28ed47d68bd9d7e56ca08837ea71eec6c9ce62802b1676c7adc923a1122dc8
-
SSDEEP
98304:xCCvLUBsgg6+Nf/mWmCI9kBqwTNOu8XRAB3jlFblKNlBWzFiSt7/C4:xzLUCgh+oz9kBZJyABTlalI5iSx64
Malware Config
Extracted
smokeloader
pub5
Extracted
vidar
40.1
706
https://eduarroma.tumblr.com/
-
profile_id
706
Extracted
nullmixer
http://hsiens.xyz/
Extracted
smokeloader
2020
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
Extracted
cryptbot
knuywu58.top
morjeo05.top
-
payload_url
http://sarefy07.top/download.php?file=lv.exe
Extracted
redline
pub1
viacetequn.site:80
Signatures
-
CryptBot payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1088-251-0x0000000003D40000-0x0000000003DE3000-memory.dmp family_cryptbot behavioral1/memory/1088-255-0x0000000003D40000-0x0000000003DE3000-memory.dmp family_cryptbot behavioral1/memory/1088-266-0x0000000003D40000-0x0000000003DE3000-memory.dmp family_cryptbot behavioral1/memory/1088-253-0x0000000003D40000-0x0000000003DE3000-memory.dmp family_cryptbot behavioral1/memory/1088-423-0x0000000003D40000-0x0000000003DE3000-memory.dmp family_cryptbot behavioral1/memory/1088-682-0x0000000003D40000-0x0000000003DE3000-memory.dmp family_cryptbot -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1456-392-0x0000000002DB0000-0x0000000002DD2000-memory.dmp family_redline behavioral1/memory/1456-410-0x0000000004E10000-0x0000000004E30000-memory.dmp family_redline -
SectopRAT payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1456-392-0x0000000002DB0000-0x0000000002DD2000-memory.dmp family_sectoprat behavioral1/memory/1456-410-0x0000000004E10000-0x0000000004E30000-memory.dmp family_sectoprat -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar Stealer 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1656-182-0x0000000002410000-0x00000000024AD000-memory.dmp family_vidar behavioral1/memory/1816-184-0x000000001B320000-0x000000001B3A0000-memory.dmp family_vidar behavioral1/memory/1656-183-0x0000000000400000-0x0000000002404000-memory.dmp family_vidar -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\7zSC6B29E36\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zSC6B29E36\libstdc++-6.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zSC6B29E36\libcurl.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zSC6B29E36\libcurlpp.dll aspack_v212_v242 -
Executes dropped EXE 1 IoCs
Processes:
setup_install.exepid process 2676 setup_install.exe -
Loads dropped DLL 11 IoCs
Processes:
0286f9b59396cd300da7e312acde0650.exesetup_install.exepid process 2924 0286f9b59396cd300da7e312acde0650.exe 2924 0286f9b59396cd300da7e312acde0650.exe 2924 0286f9b59396cd300da7e312acde0650.exe 2676 setup_install.exe 2676 setup_install.exe 2676 setup_install.exe 2676 setup_install.exe 2676 setup_install.exe 2676 setup_install.exe 2676 setup_install.exe 2676 setup_install.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process 332 2676 WerFault.exe 1624 1656 WerFault.exe Sat0191dd9aa7513876e.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
0286f9b59396cd300da7e312acde0650.exesetup_install.exedescription pid process target process PID 2924 wrote to memory of 2676 2924 0286f9b59396cd300da7e312acde0650.exe setup_install.exe PID 2924 wrote to memory of 2676 2924 0286f9b59396cd300da7e312acde0650.exe setup_install.exe PID 2924 wrote to memory of 2676 2924 0286f9b59396cd300da7e312acde0650.exe setup_install.exe PID 2924 wrote to memory of 2676 2924 0286f9b59396cd300da7e312acde0650.exe setup_install.exe PID 2924 wrote to memory of 2676 2924 0286f9b59396cd300da7e312acde0650.exe setup_install.exe PID 2924 wrote to memory of 2676 2924 0286f9b59396cd300da7e312acde0650.exe setup_install.exe PID 2924 wrote to memory of 2676 2924 0286f9b59396cd300da7e312acde0650.exe setup_install.exe PID 2676 wrote to memory of 2476 2676 setup_install.exe cmd.exe PID 2676 wrote to memory of 2476 2676 setup_install.exe cmd.exe PID 2676 wrote to memory of 2476 2676 setup_install.exe cmd.exe PID 2676 wrote to memory of 2476 2676 setup_install.exe cmd.exe PID 2676 wrote to memory of 2476 2676 setup_install.exe cmd.exe PID 2676 wrote to memory of 2476 2676 setup_install.exe cmd.exe PID 2676 wrote to memory of 2476 2676 setup_install.exe cmd.exe PID 2676 wrote to memory of 2472 2676 setup_install.exe cmd.exe PID 2676 wrote to memory of 2472 2676 setup_install.exe cmd.exe PID 2676 wrote to memory of 2472 2676 setup_install.exe cmd.exe PID 2676 wrote to memory of 2472 2676 setup_install.exe cmd.exe PID 2676 wrote to memory of 2472 2676 setup_install.exe cmd.exe PID 2676 wrote to memory of 2472 2676 setup_install.exe cmd.exe PID 2676 wrote to memory of 2472 2676 setup_install.exe cmd.exe PID 2676 wrote to memory of 2496 2676 setup_install.exe cmd.exe PID 2676 wrote to memory of 2496 2676 setup_install.exe cmd.exe PID 2676 wrote to memory of 2496 2676 setup_install.exe cmd.exe PID 2676 wrote to memory of 2496 2676 setup_install.exe cmd.exe PID 2676 wrote to memory of 2496 2676 setup_install.exe cmd.exe PID 2676 wrote to memory of 2496 2676 setup_install.exe cmd.exe PID 2676 wrote to memory of 2496 2676 setup_install.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0286f9b59396cd300da7e312acde0650.exe"C:\Users\Admin\AppData\Local\Temp\0286f9b59396cd300da7e312acde0650.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\7zSC6B29E36\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSC6B29E36\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676
-
C:\Users\Admin\AppData\Local\Temp\7zSC6B29E36\Sat01d39b63165076cf6.exeSat01d39b63165076cf6.exe1⤵PID:1816
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Abbassero.wmv1⤵PID:880
-
C:\Windows\SysWOW64\cmd.execmd2⤵PID:692
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^VHwgFRxzxxLcwcGoqrvwdRkyDDkqmNLTpdmTOMvFsotvynnSaSEGawtrcWKeGzUGIRjLVNzgHQJiNPZttzIGotBijvbSexZYgbNhjNWFndZB$" Rugiada.wmv3⤵PID:788
-
C:\Windows\SysWOW64\PING.EXEping GLTGRJAG -n 303⤵
- Runs ping.exe
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Piu.exe.comPiu.exe.com L3⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Piu.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Piu.exe.com L4⤵PID:1088
-
C:\Windows\SysWOW64\dllhost.exedllhost.exe1⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\7zSC6B29E36\Sat0156f0a157aee8a1.exe"C:\Users\Admin\AppData\Local\Temp\7zSC6B29E36\Sat0156f0a157aee8a1.exe"1⤵PID:476
-
C:\Users\Admin\AppData\Local\Temp\7zSC6B29E36\Sat0121d914644cacc0a.exeSat0121d914644cacc0a.exe1⤵PID:1752
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 4321⤵
- Program crash
PID:332
-
C:\Users\Admin\AppData\Local\Temp\7zSC6B29E36\Sat01ae6a02b12.exeSat01ae6a02b12.exe1⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\7zSC6B29E36\Sat01419f8e1c6b.exe"C:\Users\Admin\AppData\Local\Temp\7zSC6B29E36\Sat01419f8e1c6b.exe" -a1⤵PID:1460
-
C:\Users\Admin\AppData\Local\Temp\7zSC6B29E36\Sat012ff5fe8ed.exeSat012ff5fe8ed.exe1⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\7zSC6B29E36\Sat0191dd9aa7513876e.exeSat0191dd9aa7513876e.exe1⤵PID:1656
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 9282⤵
- Program crash
PID:1624
-
C:\Users\Admin\AppData\Local\Temp\7zSC6B29E36\Sat0152d2e7e2627.exeSat0152d2e7e2627.exe1⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\7zSC6B29E36\Sat0167ecaf5f3d9e0ae.exeSat0167ecaf5f3d9e0ae.exe1⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\7zSC6B29E36\Sat0156f0a157aee8a1.exeSat0156f0a157aee8a1.exe1⤵PID:2836
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat0167ecaf5f3d9e0ae.exe1⤵PID:1960
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat0121d914644cacc0a.exe1⤵PID:2984
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat01d39b63165076cf6.exe1⤵PID:2416
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat01ae6a02b12.exe1⤵PID:2172
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"1⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\7zSC6B29E36\Sat01419f8e1c6b.exeSat01419f8e1c6b.exe1⤵PID:2772
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat012ff5fe8ed.exe1⤵PID:2840
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat0191dd9aa7513876e.exe1⤵PID:2596
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat0156f0a157aee8a1.exe1⤵PID:2532
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat0152d2e7e2627.exe1⤵PID:2496
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat01419f8e1c6b.exe1⤵PID:2472
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"1⤵PID:2476
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
Filesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
Filesize
1016KB
MD5f014976a091785f58fd44e0dc8506f5f
SHA1fed23b9f1ccb7d477f8f7d2b9726c63847c4d8b4
SHA256e4c3ad8e32d399f988f3cc9b2e25044d4dfc3cc1fad284eb00d3dfb8f8474b26
SHA5121a53cdd4ae96d15bd7c01dd6c7c4e354e1774ef3b45468605e82143d9ac4f2962c7af918ed02a88d2d3bbaaecc92b5332e992d07704507efd3c1e05b6981d987
-
Filesize
819KB
MD5a50169df0a1969af50645979dcfd967e
SHA18c23dd25631e1a32dc90df269e4d65c49627f968
SHA2567871978d2a0f9917c0885755e10dda3b9b12104f29e9ceec8d536eaf0174613c
SHA5123f0d2acfb191e5f744883595a647244cadaf1e1a55e12a6190b953dbab3b493bb404441a804388a4fe82e43161a2e6c1235bcb19c338dc7c136470f9579c051d
-
Filesize
213KB
MD5b8660560107096513267242d27ab2968
SHA151bb93cd384f0f2e842aa61f8a6b6752dc0d9fe3
SHA2566a4559c7199be952ff31963760c785622131ab7d60065a50f08d1287234a7dac
SHA51296afe436ef4b8a28cdd860bb2d3655d27fe1f59df0bcbca25a0b62ba750e0881dfd1253a233b4223ff9bfe987fba39d3d80fbc6eb92d3cb5a96c1b7e6f126dfb
-
Filesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
Filesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
Filesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
Filesize
381KB
MD58c52cb7d2c933acaf76979363f53ee84
SHA171f8633ca1f81cb294c844df0b865e2b99cd4b30
SHA256f7b2c27ff29a312c1621540340a01ef0524fd2df7edbd073882472df34071927
SHA512e74940e36916d130457a6bbf24ea4f76515e51e132a49876f0d208783e57d31d8e84c15d9fc1d5d36ffc7d3bc6907d85985dc95dd63ab6625a6aa0b7ffd72b49
-
Filesize
2.1MB
MD51f91ac37f4384a24f64c1f2ce7befc1f
SHA1f35387f1a0cf5ed5539485b7bcd0d8d50860b0bd
SHA25665e481660282fa451016d63be21c830287e594c52376aa3449cbb69f5330b4f7
SHA51262df784edb1ee1f56f0f785bf0ebe5fcdf49631c2267919c01b04face61e28385b874b1ebdf96f19ecec4d2e510e332d5c7cac13fff6cb38211a7f35756e2665
-
Filesize
1.9MB
MD50ea74481ae8529f310ec59a0806db906
SHA1eff653c14d64fbd71de39e7ca2c7782d37569843
SHA256599041e2bcb984bb05c0ead89ac76df72257860e7880cc1e9668c9cba1f0f47b
SHA512d053949dbd1492c5b88903857d063ad0e157d348a158b851f9026068172d0efb4b29460268dccfbcf5acf8f42c0907fd6893ea943cf0289a9b6824630b024018
-
Filesize
2.0MB
MD53c20ecf283b4a910da7bb6ebf6fc594a
SHA1ced5618bba605ddb2c746e151cf3e4154bba79be
SHA256006f93ae4a31602646e1fc4387d8d659d1181e55af3a570e0368be841b25d42b
SHA51226b45e8a7526f20eea0228946828dab98b17a8ad0092c502b8b35565b69ba61943c388a0e444cacc05af4623b34b7e7559a3f2d2186878e965b51b7178d591ba
-
Filesize
901KB
MD5e46987a0518998fc921d1beea4c9c8af
SHA1585fa8442e7f49247545fd899967b0149ecad260
SHA256055206cbc8a07bd1f641e05e6eb26a3cf94f402984d28dfa45707a870ec439e3
SHA5120f8bbb4f5e2224690ceda9596a1fc8cbfa6f27928d45c21390adfe4bd9529a714068dca69cbf66f9c054ca8626dd02b9d6ff3b3437f4bd3085241c4bc21edd00
-
Filesize
304KB
MD5202fbf5e60a03c2431ef0bf65840ecbc
SHA12042074db169db6fcdac5a0a235bc6ebdccf954c
SHA2569d139b0d9d99df9dfde5e7048cd37f313fc4cca2a4791b0ea33b149b578437c7
SHA51261e8d7c0d068a4f9d0c5423e6139895fa699772b5b0cbc1e1dd66b0b84bebf60ce67511b3a29c66e6b8ce013d2548eab053d4a369fdad4919babb0f3d33c1dce
-
Filesize
164KB
MD57797b4672e05ae6836d4eac651c7c159
SHA1694d21e384215355284e2cb53bd4a56714d2a9b6
SHA2562483b497f3199460cb6b8d92f0fbb68a4481240aed748c4fc311e39852003e15
SHA512cd23b0c62f2665530d758497f2a2669efe33ada730d3b8947bd2a3f7da33081a6b65e9b32871c05a9d543717bb33e58d87bdc53e556910b2bd1db25c85009ad0