Analysis
-
max time kernel
0s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
31-12-2023 07:08
General
-
Target
2ccaeaf721c1ae29a84714ee5aca4f02.exe
-
Size
5.7MB
-
MD5
2ccaeaf721c1ae29a84714ee5aca4f02
-
SHA1
c6b1a42e7dcf10aa81f76e8a9ea18b1ca1fd9037
-
SHA256
088559f2192fe04ad85f83e1a3ac931f2bdbb5a88b4146154858d00c40b4b551
-
SHA512
c00750ec16ac21a640f2e39952dede04bb975ae276f8a4ca30c78e6c8c2783d8eb4dabc499588b7f72c35cd16737f8abf871f48188271d8a8c6c1f740be09aa9
-
SSDEEP
98304:xmCvLUBsgU0L6mf8dNC1hmxxQwZ6xYQ2TZy+O1tkEdTBGg8VWzVw:xPLUCgUkJYxxUV25+tkJg+WzW
Malware Config
Extracted
nullmixer
http://marisana.xyz/
Extracted
vidar
40
706
https://lenak513.tumblr.com/
-
profile_id
706
Extracted
smokeloader
pub6
Signatures
-
Detect ZGRat V1 1 IoCs
-
NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
ZGRat
ZGRat is remote access trojan written in C#.
-
Vidar Stealer 2 IoCs
-
ASPack v2.12-2.42 2 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ccaeaf721c1ae29a84714ee5aca4f02.exe"C:\Users\Admin\AppData\Local\Temp\2ccaeaf721c1ae29a84714ee5aca4f02.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS43A27367\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS43A27367\setup_install.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 79d822fc709e78.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS43A27367\79d822fc709e78.exe79d822fc709e78.exe4⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 5723⤵
- Program crash
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c b001a8f56.exe3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 2d7080268fee447.exe3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c f9a302645.exe3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 3d0c613fcb2403.exe3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c e9e6055abb695524.exe3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 20383e5a9a4c5112.exe3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 27ce46284501.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS43A27367\3d0c613fcb2403.exe3d0c613fcb2403.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1516 -ip 15161⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS43A27367\e9e6055abb695524.exe"C:\Users\Admin\AppData\Local\Temp\7zS43A27367\e9e6055abb695524.exe" -a1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS43A27367\2d7080268fee447.exe2d7080268fee447.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS43A27367\b001a8f56.exeb001a8f56.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS43A27367\e9e6055abb695524.exee9e6055abb695524.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS43A27367\20383e5a9a4c5112.exe20383e5a9a4c5112.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS43A27367\f9a302645.exef9a302645.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS43A27367\27ce46284501.exe27ce46284501.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
Filesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
Filesize
92KB
MD53947561e2e1528a3936ed77810504e80
SHA13a6891b73e59bfd230d43791914750cb1a07e126
SHA2562c6617cde9e29d37e2fe979df0458f0c62303bc233753370a28bef035b91a0dd
SHA5124bb05f9e36b65a881721bdb7ea4b8249562eb49294999be72e9189dbcb8e8822dc566b21aa61c8773c22211a59d261056746b2c2638a35b3b73d2401505654bc
-
Filesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
Filesize
3.9MB
MD5d8dcfb8e373415bffbb369560e7be978
SHA1c12141f38d0876a4a98b93c8acddd1a66a3088ae
SHA25639eac12f59a6cd91ac5750ccf59608d0009fcccd9515c06a7f0c05149289e564
SHA512175e9f2f9183ef4a946d2ac8fef6a71c76e00f92c71793091bc62f64906b2f419ba54b8a76e4c8e91a3515b25ef92899bbecc9e8d0e8bef34bcd6102d2749e3e
-
Filesize
10.8MB
-
Filesize
136KB
-
Filesize
184KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
572KB
-
Filesize
1.5MB
-
Filesize
572KB
-
Filesize
572KB
-
Filesize
152KB
-
Filesize
8.5MB
-
Filesize
152KB
-
Filesize
1.5MB
-
Filesize
140KB
-
Filesize
1.5MB
-
Filesize
152KB
-
Filesize
1.5MB
-
Filesize
100KB
-
Filesize
572KB
-
Filesize
152KB
-
Filesize
1.5MB
-
Filesize
100KB
-
Filesize
572KB
-
Filesize
1.5MB
-
Filesize
36KB
-
Filesize
47.0MB
-
Filesize
1024KB
-
Filesize
628KB
-
Filesize
47.3MB
-
Filesize
1024KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
8.1MB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
6.1MB
-
Filesize
960KB
-
Filesize
1.0MB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
72KB
-
Filesize
960KB
-
Filesize
8KB
-
Filesize
8.1MB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB