Analysis
-
max time kernel
0s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
31-12-2023 04:23
General
-
Target
28048a470181ea26c44efccc5613248d.exe
-
Size
4.4MB
-
MD5
28048a470181ea26c44efccc5613248d
-
SHA1
ecf49125ae5fbab3046a36550c7e46074acbfdb2
-
SHA256
52d2303ef0ca3af61a62ab3041abdd1782189394a97777c7d5d9b488b85f1cdd
-
SHA512
142e2b907d235d1d94d8133be70d475b1aa147c18c89a40433e4e13e78c8241b1c84a9d614be535febbb3c7ec5fe4731c681048faed6a38fa18c232829898c9d
-
SSDEEP
98304:yuROg/xvMXxNE+yK7cRAMM3mLwhd9Rb050ldg+nmJbeLMYBHSAkUBIi2:yuRb/xArEKwyMM38wtR450Dg+mVAHS2S
Malware Config
Extracted
nullmixer
http://hsiens.xyz/
Extracted
vidar
40.1
706
https://eduarroma.tumblr.com/
-
profile_id
706
Extracted
smokeloader
pub5
Extracted
redline
pub1
viacetequn.site:80
Extracted
smokeloader
2020
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
Signatures
-
NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 2 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Vidar Stealer 2 IoCs
-
ASPack v2.12-2.42 2 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\28048a470181ea26c44efccc5613248d.exe"C:\Users\Admin\AppData\Local\Temp\28048a470181ea26c44efccc5613248d.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS40FE3277\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS40FE3277\setup_install.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 5724⤵
- Program crash
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat041b8c13f01a.exe4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat0467ed277dbd5c.exe4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat04436aa032.exe4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat04a3dff8dec.exe4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat043dfd5d2de5535b.exe4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat046b489ca6a4ca7b.exe4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat044149d0d9a89f.exe4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat0489e5e7edba.exe4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat0451bd044df656.exe4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS40FE3277\Sat046b489ca6a4ca7b.exeSat046b489ca6a4ca7b.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS40FE3277\Sat041b8c13f01a.exeSat041b8c13f01a.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS40FE3277\Sat0489e5e7edba.exeSat0489e5e7edba.exe1⤵
-
C:\Windows\SysWOW64\dllhost.exedllhost.exe1⤵
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Abbassero.wmv1⤵
-
C:\Windows\SysWOW64\cmd.execmd2⤵
-
C:\Windows\SysWOW64\PING.EXEping AVCIKYMG -n 303⤵
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Piu.exe.comPiu.exe.com L3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS40FE3277\Sat0451bd044df656.exe"C:\Users\Admin\AppData\Local\Temp\7zS40FE3277\Sat0451bd044df656.exe" -a1⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^VHwgFRxzxxLcwcGoqrvwdRkyDDkqmNLTpdmTOMvFsotvynnSaSEGawtrcWKeGzUGIRjLVNzgHQJiNPZttzIGotBijvbSexZYgbNhjNWFndZB$" Rugiada.wmv1⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Piu.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Piu.exe.com L1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1644 -ip 16441⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS40FE3277\Sat04a3dff8dec.exeSat04a3dff8dec.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS40FE3277\Sat0467ed277dbd5c.exeSat0467ed277dbd5c.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS40FE3277\Sat044149d0d9a89f.exeSat044149d0d9a89f.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS40FE3277\Sat04436aa032.exeSat04436aa032.exe1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS40FE3277\Sat0451bd044df656.exeSat0451bd044df656.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS40FE3277\Sat043dfd5d2de5535b.exeSat043dfd5d2de5535b.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
Filesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
Filesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
Filesize
832KB
MD5176da3b4ae2c18efcdf8ef40acab3197
SHA1da9153f6e669140f4bea834f34fc7f5e36762777
SHA256285afb639d43b31e8a79c981312162d207d41ef110bff241e8f70c044d40bf36
SHA5124930019a62ece49638dc6f73c3d88056a095abae2013d02217e7ae6b517784a0c6dccd8d2e0bfe6ace43ecd3ef2b4f9c92a003387c1c70130b6ed925325d87ef
-
Filesize
2.1MB
MD58c4543c3763d632ac4ccdea76d425512
SHA1183753707e946d33b16b63470f189172221364fe
SHA2566ad79b3927d69e4d51409342f37f31c720be9ab0a0bbf468da5f681a67b1ed8f
SHA512dd02394c9dd20bbb9a9e53ab5378500c5b8d2a83860af868dfcc2703f0547563ee1baff58d645cfc9cb6ff355896d79e26735fb66536fbb389dbfda076e6b17d
-
Filesize
92KB
MD5d772d6902200f5d4599a9b27d0d8f9e6
SHA1564eefb3fabe655b2fb51f492959b158cb20e12d
SHA2567bf11639663306b53a7fe0e3826d12f03e1dda7b1fb3abaa758e3281d35f8e17
SHA5126682d79a013129aceba9cde75a82f0444a28d30bfbd1c4656d7e3774b469283027a780362657c908c991f9b5939db32792e6713a323667ab763a95b3f3e23d36
-
Filesize
40.8MB
-
Filesize
188KB
-
Filesize
240KB
-
Filesize
1.0MB
-
Filesize
5.6MB
-
Filesize
128KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
188KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
6.1MB
-
Filesize
304KB
-
Filesize
652KB
-
Filesize
408KB
-
Filesize
120KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
216KB
-
Filesize
64KB
-
Filesize
104KB
-
Filesize
7.7MB
-
Filesize
6.2MB
-
Filesize
120KB
-
Filesize
200KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
104KB
-
Filesize
40KB
-
Filesize
600KB
-
Filesize
68KB
-
Filesize
32KB
-
Filesize
6.5MB
-
Filesize
80KB
-
Filesize
56KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
100KB
-
Filesize
572KB
-
Filesize
572KB
-
Filesize
572KB
-
Filesize
572KB
-
Filesize
1.1MB
-
Filesize
140KB
-
Filesize
152KB
-
Filesize
1.5MB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
1.5MB
-
Filesize
572KB
-
Filesize
572KB
-
Filesize
100KB
-
Filesize
572KB
-
Filesize
152KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
31.7MB
-
Filesize
1024KB
-
Filesize
36KB
-
Filesize
88KB
-
Filesize
4KB
-
Filesize
32.0MB
-
Filesize
1024KB
-
Filesize
628KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
176KB
-
Filesize
136KB
-
Filesize
64KB