Analysis

  • max time kernel
    0s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    31-12-2023 05:43

General

  • Target

    2a7a53a25f11a4e0b70f19e1a49d5229.exe

  • Size

    1.9MB

  • MD5

    2a7a53a25f11a4e0b70f19e1a49d5229

  • SHA1

    e832b847396ad164a1d3af7745a3d68da4c5631f

  • SHA256

    356b0cafa50b44b352ff1f95515b81af4ef5a5269343d8c459306b8d3261a58d

  • SHA512

    cfad611e542f36acf94b4cfb6f54daec7c42cba48c5f3b761ee09bc02bc79889da262f887592aea9e24436a489894f7211d8378cf1b038378303824166b6667e

  • SSDEEP

    49152:9gm6jSI2tM+C2a3EzO079E4dcjmlxcoe8TeOkw80AtNkJs8tX0SN+gSD1h:y1oe+Cr3gO+W4qmfVK3wTsNohi51h

Malware Config

Extracted

Family

vidar

Version

40

Botnet

706

C2

https://lenak513.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family

smokeloader

Botnet

pub5

Extracted

Family

nullmixer

C2

http://watira.xyz/

Extracted

Family

smokeloader

Version

2020

C2

http://aucmoney.com/upload/

http://thegymmum.com/upload/

http://atvcampingtrips.com/upload/

http://kuapakualaman.com/upload/

http://renatazarazua.com/upload/

http://nasufmutlu.com/upload/

rc4.i32
rc4.i32

Signatures

  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar Stealer 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2a7a53a25f11a4e0b70f19e1a49d5229.exe
    "C:\Users\Admin\AppData\Local\Temp\2a7a53a25f11a4e0b70f19e1a49d5229.exe"
    1⤵
      PID:2444
      • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2640
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 49b64a222d62322.exe
      1⤵
        PID:3028
        • C:\Users\Admin\AppData\Local\Temp\7zS05AC4D06\49b64a222d62322.exe
          49b64a222d62322.exe
          2⤵
            PID:1560
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 952
              3⤵
              • Program crash
              PID:2420
        • C:\Users\Admin\AppData\Local\Temp\7zS05AC4D06\e2651aae101285.exe
          "C:\Users\Admin\AppData\Local\Temp\7zS05AC4D06\e2651aae101285.exe" -a
          1⤵
            PID:1260
          • C:\Users\Admin\AppData\Local\Temp\7zS05AC4D06\d128da868eace63.exe
            d128da868eace63.exe
            1⤵
              PID:1504
            • C:\Users\Admin\AppData\Local\Temp\7zS05AC4D06\671e9c9b76adcf6.exe
              671e9c9b76adcf6.exe
              1⤵
                PID:1556
              • C:\Users\Admin\AppData\Local\Temp\7zS05AC4D06\e2651aae101285.exe
                e2651aae101285.exe
                1⤵
                  PID:1360
                • C:\Users\Admin\AppData\Local\Temp\7zS05AC4D06\49b456537.exe
                  49b456537.exe
                  1⤵
                    PID:848
                  • C:\Users\Admin\AppData\Local\Temp\7zS05AC4D06\49f7436351.exe
                    49f7436351.exe
                    1⤵
                      PID:2996
                    • C:\Users\Admin\AppData\Local\Temp\7zS05AC4D06\c3fd6c993b4.exe
                      c3fd6c993b4.exe
                      1⤵
                        PID:2896
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c 671e9c9b76adcf6.exe
                        1⤵
                          PID:2872
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c 49b456537.exe
                          1⤵
                            PID:2864
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c e2651aae101285.exe
                            1⤵
                              PID:2868
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c d128da868eace63.exe
                              1⤵
                                PID:2828
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c c3fd6c993b4.exe
                                1⤵
                                  PID:1592
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c 49f7436351.exe
                                  1⤵
                                    PID:3016
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 408
                                    1⤵
                                    • Program crash
                                    PID:776
                                  • C:\Users\Admin\AppData\Local\Temp\7zS05AC4D06\setup_install.exe
                                    "C:\Users\Admin\AppData\Local\Temp\7zS05AC4D06\setup_install.exe"
                                    1⤵
                                      PID:2696

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Temp\7zS05AC4D06\libwinpthread-1.dll

                                      Filesize

                                      69KB

                                      MD5

                                      1e0d62c34ff2e649ebc5c372065732ee

                                      SHA1

                                      fcfaa36ba456159b26140a43e80fbd7e9d9af2de

                                      SHA256

                                      509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

                                      SHA512

                                      3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

                                    • C:\Users\Admin\AppData\Local\Temp\7zS05AC4D06\setup_install.exe

                                      Filesize

                                      2.4MB

                                      MD5

                                      302fc869c0280dcc7c2d5f9037f145b5

                                      SHA1

                                      d5312f84f06eb9743eea9cc2a70d5a1b4cae978e

                                      SHA256

                                      96486cd072c49dadd037b5759623d5ff9afcc29ab9ed621f304e506189b86133

                                      SHA512

                                      57ac48a4e1a0d79d1e75b63f15a7f8d76bc6294abe9c1e21832738a915eb64b42237fcc4014753e652d8eacb223cc83aac2a22fe951d0fb45aa4a9a21bda6278

                                    • C:\Users\Admin\AppData\Local\Temp\7zS05AC4D06\setup_install.exe

                                      Filesize

                                      381KB

                                      MD5

                                      ce3f2b4ed7f6aba3906306552cfc1545

                                      SHA1

                                      c7d742c63f5cd95955b259e6ebdc1bcc44365850

                                      SHA256

                                      79e7d8f2016bfacef67f0f83a5ff9cb52c7bc23113e5c313c2e797da85da85d7

                                      SHA512

                                      3503f55cdc79401fd76de0c48eadbe8cc764ddb16b2ed63a3506e1ff8d9045c88670fb24a3340a122977c869a415f85c16d090c8ffaa6f9ee4ecba7a5f5b935b

                                    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe

                                      Filesize

                                      92KB

                                      MD5

                                      d772d6902200f5d4599a9b27d0d8f9e6

                                      SHA1

                                      564eefb3fabe655b2fb51f492959b158cb20e12d

                                      SHA256

                                      7bf11639663306b53a7fe0e3826d12f03e1dda7b1fb3abaa758e3281d35f8e17

                                      SHA512

                                      6682d79a013129aceba9cde75a82f0444a28d30bfbd1c4656d7e3774b469283027a780362657c908c991f9b5939db32792e6713a323667ab763a95b3f3e23d36

                                    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe

                                      MD5

                                      d41d8cd98f00b204e9800998ecf8427e

                                      SHA1

                                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                                      SHA256

                                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                      SHA512

                                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                    • \Users\Admin\AppData\Local\Temp\7zS05AC4D06\setup_install.exe

                                      Filesize

                                      3.4MB

                                      MD5

                                      54505a3a0ba8f4379f1dabead3711a26

                                      SHA1

                                      c516fcbb3eebb05d2e818de0696ac65f50baaa6b

                                      SHA256

                                      9e67a053b6761e2418586bc0d6dccb1f1d86baa05e46b37fc2735c57ce3f6e7d

                                      SHA512

                                      2f184269bf358459de906f54c33280def6fbc54fd92b0cf5def05f85355631e03cbab62a0513232f56eeee39993b3e5c5a85c41d4be93cb8d62ac55e30602d66

                                    • \Users\Admin\AppData\Local\Temp\7zS05AC4D06\setup_install.exe

                                      Filesize

                                      1.4MB

                                      MD5

                                      10d261cf02d9341bbd89952785830a3f

                                      SHA1

                                      e9d3001c3805f2a6ef214ae24faf251866644e34

                                      SHA256

                                      12006c24e9e356216842871acf8bd9f373ee024de50c2fc5150dab3a19fe86d1

                                      SHA512

                                      1651da4af9053dada9b09c6bc3e8245614656d86a33312d2d09571f1cd3b783b2f00b71e5ca63ac43a145103c199776b848d1877038c995c25ff24d87e6966a4

                                    • \Users\Admin\AppData\Local\Temp\7zS05AC4D06\setup_install.exe

                                      Filesize

                                      893KB

                                      MD5

                                      4f92cdcf9b3545d427cc9d75d5bb62e3

                                      SHA1

                                      78dcfe14d712a2212aeb2f31720947bd414a50e8

                                      SHA256

                                      13e028df787dc990d8b3eb48c678d09ad5de777e3752ef0032a6c31b9a7be752

                                      SHA512

                                      053739750c94b3bfa6c30a8fee2fa648ec80dd311ff58bc56255101afce557c06ae0a152710127b2cb4913749f881fec80645fd5fedc2c130c7fc1d512fb14cd

                                    • \Users\Admin\AppData\Local\Temp\setup_installer.exe

                                      Filesize

                                      1.9MB

                                      MD5

                                      514f856967233888b92235662dee2d4a

                                      SHA1

                                      73d4ff7cbd1fe1f87f4ac3dfb58c247ed197d527

                                      SHA256

                                      98c879d5cffd45d3ebefbece199ef1e9f885ce1cffc5799459b4f8156d9b45ca

                                      SHA512

                                      dd4d2ee9068a97b3f8eeaefdd37b2557afb416e5553018e87617d889ca8f84d9bbd3ee3d599cc73121218370a22c6eeedbfd27d1fdd85b10c1798b7bf5471abe

                                    • memory/848-124-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

                                      Filesize

                                      9.9MB

                                    • memory/848-122-0x00000000003C0000-0x00000000003C6000-memory.dmp

                                      Filesize

                                      24KB

                                    • memory/848-128-0x0000000000400000-0x0000000000406000-memory.dmp

                                      Filesize

                                      24KB

                                    • memory/848-276-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

                                      Filesize

                                      9.9MB

                                    • memory/848-279-0x000000001AB40000-0x000000001ABC0000-memory.dmp

                                      Filesize

                                      512KB

                                    • memory/848-125-0x00000000003E0000-0x0000000000402000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/848-118-0x0000000000F40000-0x0000000000F70000-memory.dmp

                                      Filesize

                                      192KB

                                    • memory/848-132-0x000000001AB40000-0x000000001ABC0000-memory.dmp

                                      Filesize

                                      512KB

                                    • memory/848-341-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

                                      Filesize

                                      9.9MB

                                    • memory/1068-223-0x0000000003CC0000-0x0000000003CD6000-memory.dmp

                                      Filesize

                                      88KB

                                    • memory/1560-277-0x00000000002E0000-0x00000000003E0000-memory.dmp

                                      Filesize

                                      1024KB

                                    • memory/1560-237-0x0000000000400000-0x0000000002CBE000-memory.dmp

                                      Filesize

                                      40.7MB

                                    • memory/1560-129-0x0000000000400000-0x0000000002CBE000-memory.dmp

                                      Filesize

                                      40.7MB

                                    • memory/1560-126-0x00000000002E0000-0x00000000003E0000-memory.dmp

                                      Filesize

                                      1024KB

                                    • memory/1560-127-0x0000000004A50000-0x0000000004AED000-memory.dmp

                                      Filesize

                                      628KB

                                    • memory/2696-53-0x0000000064940000-0x0000000064959000-memory.dmp

                                      Filesize

                                      100KB

                                    • memory/2696-233-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                      Filesize

                                      152KB

                                    • memory/2696-58-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                      Filesize

                                      1.5MB

                                    • memory/2696-51-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                      Filesize

                                      572KB

                                    • memory/2696-50-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                      Filesize

                                      1.5MB

                                    • memory/2696-44-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                      Filesize

                                      572KB

                                    • memory/2696-41-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                      Filesize

                                      152KB

                                    • memory/2696-59-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                      Filesize

                                      1.5MB

                                    • memory/2696-60-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                      Filesize

                                      1.5MB

                                    • memory/2696-61-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                      Filesize

                                      152KB

                                    • memory/2696-62-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                      Filesize

                                      152KB

                                    • memory/2696-63-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                      Filesize

                                      152KB

                                    • memory/2696-52-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                      Filesize

                                      572KB

                                    • memory/2696-55-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                      Filesize

                                      572KB

                                    • memory/2696-232-0x0000000064940000-0x0000000064959000-memory.dmp

                                      Filesize

                                      100KB

                                    • memory/2696-57-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                      Filesize

                                      1.5MB

                                    • memory/2696-234-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                      Filesize

                                      572KB

                                    • memory/2696-231-0x0000000000400000-0x00000000006E2000-memory.dmp

                                      Filesize

                                      2.9MB

                                    • memory/2696-236-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                      Filesize

                                      1.5MB

                                    • memory/2696-235-0x000000006EB40000-0x000000006EB63000-memory.dmp

                                      Filesize

                                      140KB

                                    • memory/2896-227-0x0000000000250000-0x0000000000259000-memory.dmp

                                      Filesize

                                      36KB

                                    • memory/2896-224-0x0000000000400000-0x0000000002C62000-memory.dmp

                                      Filesize

                                      40.4MB

                                    • memory/2896-131-0x0000000000400000-0x0000000002C62000-memory.dmp

                                      Filesize

                                      40.4MB

                                    • memory/2896-108-0x00000000030D0000-0x00000000031D0000-memory.dmp

                                      Filesize

                                      1024KB

                                    • memory/2896-111-0x0000000000250000-0x0000000000259000-memory.dmp

                                      Filesize

                                      36KB

                                    • memory/2996-130-0x000000001B070000-0x000000001B0F0000-memory.dmp

                                      Filesize

                                      512KB

                                    • memory/2996-272-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

                                      Filesize

                                      9.9MB

                                    • memory/2996-278-0x000000001B070000-0x000000001B0F0000-memory.dmp

                                      Filesize

                                      512KB

                                    • memory/2996-123-0x000007FEF5C50000-0x000007FEF663C000-memory.dmp

                                      Filesize

                                      9.9MB

                                    • memory/2996-117-0x00000000001C0000-0x00000000001C8000-memory.dmp

                                      Filesize

                                      32KB