Analysis
-
max time kernel
0s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
31/12/2023, 07:23
General
-
Target
2d3e5a2a2243d788901fb182156f4031.exe
-
Size
4.5MB
-
MD5
2d3e5a2a2243d788901fb182156f4031
-
SHA1
acf66cababaeba6d72e72d2962405f41052d79a0
-
SHA256
a5f4eb3b915bcfdd72cb81b7d89c0c0fd6b190b637db6ffad25604d24985f9e8
-
SHA512
74287eab6153bb074dc6b5c2f25624b70a4bda2eb54a1071a37a4adf0781646b7ecdccfc86e794ce1d6ceeb75b070f0e8ea78c9642fa67147f3c806f03245888
-
SSDEEP
98304:Jwg2hGtNVybTZMYTX1Wnlz1vdN0J5Nfm/Fb0bIQ81NN25Fv:JwvhoybtMYxWZBGBm9b0bIJ5Ol
Malware Config
Extracted
nullmixer
http://sokiran.xyz/
Extracted
smokeloader
pub5
Extracted
vidar
39.4
706
https://sergeevih43.tumblr.com/
-
profile_id
706
Extracted
redline
DomAni
ergerr3.top:80
Extracted
smokeloader
2020
http://ppcspb.com/upload/
http://mebbing.com/upload/
http://twcamel.com/upload/
http://howdycash.com/upload/
http://lahuertasonora.com/upload/
http://kpotiques.com/upload/
Signatures
-
NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Nirsoft 6 IoCs
-
Vidar Stealer 4 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d3e5a2a2243d788901fb182156f4031.exe"C:\Users\Admin\AppData\Local\Temp\2d3e5a2a2243d788901fb182156f4031.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS84280507\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS84280507\setup_install.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS84280507\sonia_3.exesonia_3.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 10442⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\7zS84280507\sonia_5.exesonia_5.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS84280507\sonia_6.exeC:\Users\Admin\AppData\Local\Temp\7zS84280507\sonia_6.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\liqian.exe"C:\Users\Admin\AppData\Local\Temp\liqian.exe"1⤵
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 6083⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt1⤵
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",getmft1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5020 -ip 50201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 5441⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 620 -ip 6201⤵
-
C:\Users\Admin\AppData\Local\Temp\UGloryStp.exe"C:\Users\Admin\AppData\Local\Temp\UGloryStp.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS84280507\sonia_4.exesonia_4.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7zS84280507\sonia_6.exesonia_6.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS84280507\sonia_7.exesonia_7.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS84280507\sonia_2.exesonia_2.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5292 -s 3962⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\7zS84280507\sonia_1.exesonia_1.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_7.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_6.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_5.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_4.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_3.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_2.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_1.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5292 -ip 52921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3448 -ip 34481⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
225KB
MD53c5befb2d5ea426202a35707016d4996
SHA1bc0bfa794f196db39697ffc5d91cc4f331b0ebc4
SHA2561d8900c446e33374b82a8849eb66a0af2df370eec99864826e69c671745536dd
SHA51240c3f5aaefb3154efd0a44931fb4c50b54db77da177d6926015359e6e5f2dd51cc11dbf0b90759bcc91300079372d5f9d9751972b1153ad8dbb990220166ebf3
-
Filesize
72KB
-
Filesize
304KB
-
Filesize
7.7MB
-
Filesize
1.0MB
-
Filesize
7.7MB
-
Filesize
120KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
240KB
-
Filesize
6.1MB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
364KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
88KB
-
Filesize
1024KB
-
Filesize
744KB
-
Filesize
628KB
-
Filesize
744KB
-
Filesize
628KB
-
Filesize
572KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
1.5MB
-
Filesize
140KB
-
Filesize
100KB
-
Filesize
572KB
-
Filesize
100KB
-
Filesize
572KB
-
Filesize
572KB
-
Filesize
572KB
-
Filesize
1.5MB
-
Filesize
152KB
-
Filesize
1.1MB
-
Filesize
1.5MB
-
Filesize
152KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
408KB
-
Filesize
36KB
-
Filesize
1024KB
-
Filesize
408KB
-
Filesize
136KB
-
Filesize
120KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
400KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
1.8MB