Analysis
-
max time kernel
0s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30-12-2023 02:06
General
-
Target
0b174fea183b59e9fd82bbbf4d6ca51a.exe
-
Size
3.9MB
-
MD5
0b174fea183b59e9fd82bbbf4d6ca51a
-
SHA1
d3a5217af89a4144b292798fe35b81981f16f640
-
SHA256
7e85e9eea33b5c3576d801f9206cba0132f81e569c31e0f76f0ba9229b50b083
-
SHA512
6359c2dd3d33a519831d05ec058e3caaba6de4be2911ad1e519412e04d1d1ec537b07add719f366b4fa6936187a3e10c268e307fceca5eaaaa7278198085cd75
-
SSDEEP
98304:xDCvLUBsgUtB/0xIOUg2im1HKHSCK85OXovU/FqL:x4LUCgQZ0mS2im1qSZaFUc
Malware Config
Extracted
nullmixer
http://razino.xyz/
Extracted
smokeloader
pub5
Extracted
vidar
39.3
706
https://bandakere.tumblr.com/
-
profile_id
706
Extracted
smokeloader
2020
http://ppcspb.com/upload/
http://mebbing.com/upload/
http://twcamel.com/upload/
http://howdycash.com/upload/
http://lahuertasonora.com/upload/
http://kpotiques.com/upload/
Signatures
-
NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Nirsoft 2 IoCs
-
Vidar Stealer 4 IoCs
-
ASPack v2.12-2.42 3 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b174fea183b59e9fd82bbbf4d6ca51a.exe"C:\Users\Admin\AppData\Local\Temp\0b174fea183b59e9fd82bbbf4d6ca51a.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS44C6D907\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS44C6D907\setup_install.exe"2⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c metina_2.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS44C6D907\metina_2.exemetina_2.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 3963⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-JT5M1.tmp\metina_5.tmp"C:\Users\Admin\AppData\Local\Temp\is-JT5M1.tmp\metina_5.tmp" /SL5="$8005E,189670,105984,C:\Users\Admin\AppData\Local\Temp\7zS44C6D907\metina_5.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 4601⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 976 -ip 9761⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4016 -ip 40161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 6001⤵
- Program crash
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",init1⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SVHOST.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SVHOST.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SVHOST.exe"C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SVHOST.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7zS44C6D907\metina_3.exemetina_3.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 10402⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\7zS44C6D907\metina_5.exemetina_5.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS44C6D907\metina_7.exemetina_7.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS44C6D907\metina_6.exemetina_6.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS44C6D907\metina_4.exemetina_4.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7zS44C6D907\metina_1.exemetina_1.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c metina_7.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c metina_6.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c metina_5.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c metina_4.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c metina_3.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c metina_1.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3816 -ip 38161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1272 -ip 12721⤵
-
C:\Users\Admin\AppData\Roaming\urvwhgwC:\Users\Admin\AppData\Roaming\urvwhgw1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 4082⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3172 -ip 31721⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
Filesize
290KB
MD5af41d6d43df35d8c831695e584169a71
SHA1bb8d6f081e93d2860ce62fabefbe9cdf80ebf06e
SHA256cbab323219211a8bb57f5b0ee9bdd97b45724c61da8b842f02174ed87f908141
SHA5125fce8bb65d14ca38178ac1cf9ba7d012a2e64b7af9ae3c6cf31b6cf7be44708474b9381da50cb9c9eea9a4b0429eb4b2e280afba0424b6f5ef0a26379221af9a
-
Filesize
92KB
MD566e4d85d4ca9857cf96683f0a03956a1
SHA1658d0f967a411314dc5e0f8d8da583c611eca53c
SHA256f58ea6ce680f31fb59c3b69588e6be86a400e6963782a8466cb62b92e5304d73
SHA512c20f28cc43720694338fba1f12e2a68ac80ad669b960b337c502a9c4765c184a466a2da474e0181da081c97ea54f9c3aea59cdb66bbe0d6e7d455be62ce5835e
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
1.1MB
-
Filesize
152KB
-
Filesize
572KB
-
Filesize
152KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.1MB
-
Filesize
1.5MB
-
Filesize
1.1MB
-
Filesize
1.5MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
572KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
572KB
-
Filesize
140KB
-
Filesize
572KB
-
Filesize
100KB
-
Filesize
1.5MB
-
Filesize
100KB
-
Filesize
152KB
-
Filesize
572KB
-
Filesize
1.5MB
-
Filesize
152KB
-
Filesize
572KB
-
Filesize
604KB
-
Filesize
1024KB
-
Filesize
8.4MB
-
Filesize
8.4MB
-
Filesize
604KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
6.1MB
-
Filesize
120KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
364KB
-
Filesize
8.1MB
-
Filesize
8.1MB
-
Filesize
1024KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
36KB
-
Filesize
8.1MB
-
Filesize
1024KB
-
Filesize
36KB
-
Filesize
8.1MB
-
Filesize
804KB
-
Filesize
4KB
-
Filesize
224KB
-
Filesize
548KB
-
Filesize
584KB
-
Filesize
152KB
-
Filesize
40KB
-
Filesize
624KB
-
Filesize
7.7MB
-
Filesize
3.3MB
-
Filesize
488KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
5.6MB
-
Filesize
1.1MB
-
Filesize
7.7MB