Analysis
-
max time kernel
0s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
30-12-2023 14:23
General
-
Target
1b5164f044f2c3a2cc01b2448bc0eb8a.exe
-
Size
2.6MB
-
MD5
1b5164f044f2c3a2cc01b2448bc0eb8a
-
SHA1
d1b28f3d20560aa3ae207843b2605d53f645247e
-
SHA256
318c2194ae43ddccf9ccf21d07087c6059683d3aba0d04f4fd720d503095950d
-
SHA512
4ad85a2b6b4591ac690a16f778e38a514470fb078948b974e525b0388abc316df75add8df3b02016adae44918450fa9762d2e1887ccf6c64b5bdda10085b056f
-
SSDEEP
49152:EgBtIhtz0tHnR8mxEYh4YkoVZCiMDf4j/Ee3O9ilydBFgabowS9c/aA:JBt2tzcKmy04K4y/9BydBXokSA
Malware Config
Extracted
nullmixer
http://lotzini.xyz/
Extracted
smokeloader
pub5
Extracted
vidar
39.7
933
https://shpak125.tumblr.com/
-
profile_id
933
Extracted
smokeloader
2020
http://conceitosseg.com/upload/
http://integrasidata.com/upload/
http://ozentekstil.com/upload/
http://finbelportal.com/upload/
http://telanganadigital.com/upload/
Signatures
-
NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Vidar Stealer 3 IoCs
-
ASPack v2.12-2.42 2 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b5164f044f2c3a2cc01b2448bc0eb8a.exe"C:\Users\Admin\AppData\Local\Temp\1b5164f044f2c3a2cc01b2448bc0eb8a.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_7.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS42752626\sahiba_7.exesahiba_7.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7zS42752626\sahiba_1.exe"C:\Users\Admin\AppData\Local\Temp\7zS42752626\sahiba_1.exe" -a1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 4081⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
-
C:\Users\Admin\AppData\Local\Temp\7zS42752626\sahiba_3.exesahiba_3.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 9322⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\7zS42752626\sahiba_6.exesahiba_6.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS42752626\sahiba_1.exesahiba_1.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS42752626\sahiba_5.exesahiba_5.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS42752626\sahiba_4.exesahiba_4.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS42752626\sahiba_2.exesahiba_2.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_6.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_5.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_4.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_3.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_2.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sahiba_1.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS42752626\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS42752626\setup_install.exe"1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
287KB
MD5b107ead1f6283a5015291f05a95e2925
SHA12ccdbe2634ac6df52d3d92c3cbf050b1eba6a039
SHA2569d8516a59bc0e5dc78c032ae2ab2133eaa17055e76805d036df85c9384d542e9
SHA512d9dea1e930273896a7a87f81b9e1282064f8f620d3438d59136f59b4d7383430fc1c959184f1b4ae7d872573b97e423858ad3ec976a26bc09caeaa549ce7456a
-
Filesize
92KB
MD5d772d6902200f5d4599a9b27d0d8f9e6
SHA1564eefb3fabe655b2fb51f492959b158cb20e12d
SHA2567bf11639663306b53a7fe0e3826d12f03e1dda7b1fb3abaa758e3281d35f8e17
SHA5126682d79a013129aceba9cde75a82f0444a28d30bfbd1c4656d7e3774b469283027a780362657c908c991f9b5939db32792e6713a323667ab763a95b3f3e23d36
-
Filesize
92KB
MD55044ea78f1dd8a2de2b258641bc6bd67
SHA17b31b1bb312ea4537e435d05767b9e7ef9d0ec84
SHA2560b227ac37c9d88683743327227ef6ab39d1b1b27873458f34caf288ab25730a3
SHA512ad96d8787b7ae3887c5bc9eab5b354daf8e9302477ea0c96ed1090393544ab577a96952a5bedfb5577e60cf69429e8c6b17f1223ee915d3c12af51b3c27b9eff
-
Filesize
2.4MB
MD5582f8463e84bfad35941fadc41066b8e
SHA1ed67a80ae56d15ff501c4a9e3c296206db12535f
SHA25645201558ce4d5cb619357520a466524ecd55e6b4427b21d72b12feb4bfe0ef47
SHA512b466d13461bdd624ff3af46074471b36059122dd7289f2ed918fe99320936778cfc98fddd360e7d95600ba4c900a2b378914bbc581251831ddf04011c32d52f8
-
Filesize
372KB
-
Filesize
1.0MB
-
Filesize
304KB
-
Filesize
452KB
-
Filesize
452KB
-
Filesize
452KB
-
Filesize
452KB
-
Filesize
452KB
-
Filesize
452KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
452KB
-
Filesize
304KB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
32KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
84KB
-
Filesize
36KB
-
Filesize
1024KB
-
Filesize
39.4MB
-
Filesize
39.4MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
100KB
-
Filesize
572KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
152KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
572KB
-
Filesize
1.5MB
-
Filesize
572KB
-
Filesize
152KB
-
Filesize
100KB
-
Filesize
572KB
-
Filesize
152KB
-
Filesize
1.1MB
-
Filesize
572KB
-
Filesize
140KB
-
Filesize
1.1MB
-
Filesize
152KB
-
Filesize
1.5MB
-
Filesize
512KB
-
Filesize
24KB
-
Filesize
176KB
-
Filesize
248KB
-
Filesize
9.9MB
-
Filesize
24KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
628KB
-
Filesize
39.8MB
-
Filesize
1024KB
-
Filesize
39.8MB
-
Filesize
1024KB