Analysis
-
max time kernel
0s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
31-12-2023 10:43
General
-
Target
32f704bce081a0aa5c9368ab339dc11b.exe
-
Size
3.1MB
-
MD5
32f704bce081a0aa5c9368ab339dc11b
-
SHA1
a49c71e11b0d6addde2b7f3b0196c8577030bb93
-
SHA256
9674d5eec506800988ac7469acafaab10d6c879c83aba6ccb023935de5cd2a0e
-
SHA512
f9023e504f2542b44a5a04e87049109c4bd42d31069e3f652715968ed0d252a06eb0466959766634650072d12b9be50fbdf443618d59a48c2f5718173a2f6996
-
SSDEEP
49152:xcBOcIk9r0Gc9tZP+9HqQfbGu2h+xbRZn2zCcEMz+q/uPEwJ84vLRaBtIl9mTv/c:xeGV9rMqQiuZlZ2zLEnq/ZCvLUBsK3kZ
Malware Config
Extracted
vidar
39.4
706
https://sergeevih43.tumblr.com/
-
profile_id
706
Extracted
smokeloader
2020
http://ppcspb.com/upload/
http://mebbing.com/upload/
http://twcamel.com/upload/
http://howdycash.com/upload/
http://lahuertasonora.com/upload/
http://kpotiques.com/upload/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Nirsoft 1 IoCs
-
Vidar Stealer 2 IoCs
-
ASPack v2.12-2.42 3 IoCs
Detects executables packed with ASPack v2.12-2.42
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\32f704bce081a0aa5c9368ab339dc11b.exe"C:\Users\Admin\AppData\Local\Temp\32f704bce081a0aa5c9368ab339dc11b.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4E4D6A26\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS4E4D6A26\setup_install.exe"2⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_7.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4E4D6A26\arnatic_7.exearnatic_7.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4E4D6A26\arnatic_7.exeC:\Users\Admin\AppData\Local\Temp\7zS4E4D6A26\arnatic_7.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS4E4D6A26\arnatic_1.exearnatic_1.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 9442⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\7zS4E4D6A26\arnatic_4.exearnatic_4.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7zS4E4D6A26\arnatic_6.exearnatic_6.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4E4D6A26\arnatic_3.exearnatic_3.exe1⤵
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7zS4E4D6A26\arnatic_2.exearnatic_2.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 4081⤵
- Program crash
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4E4D6A26\arnatic_5.exearnatic_5.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_6.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_5.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_4.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_3.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_2.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_1.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
290KB
MD5ab6f04ecf25fa271f6eb2709720eb15e
SHA162485253a7a6ac939e63e44f4a60af9e6d15dff1
SHA256504717007e19e8f78bd9ca5358b0d2b738af94c2333f9fbae4392dff3279e0b3
SHA5128bad4f022d92ef73224a958d585aa5d8f3cc69638aaf74a2d39eaf8ad52e572deb1c668b362b9f54430113c43307f12e992bdce76932ede666f53cb8fe899170
-
Filesize
92KB
MD53f67ae2f2bbc590ad30203fdf9189e5c
SHA1ca105dd8d597e1cebe66bc104d0d8acbd25f73c6
SHA25637ab2dc594e5e93816bb28da63890e81deb735c26568efa12274e46138a89b05
SHA512be6213cf4cb21685671c1dc225ca2074ddd81c50669c1a8861fbfc0e49b7146eec7aa13e91132994769183b42d32d76871cc77502d4e9202b4f6c73f8183c477
-
Filesize
1.0MB
-
Filesize
372KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
452KB
-
Filesize
304KB
-
Filesize
452KB
-
Filesize
88KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
208KB
-
Filesize
24KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
24KB
-
Filesize
9.9MB
-
Filesize
160KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
4KB
-
Filesize
120KB
-
Filesize
452KB
-
Filesize
452KB
-
Filesize
304KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
408KB
-
Filesize
1.5MB
-
Filesize
100KB
-
Filesize
1.1MB
-
Filesize
572KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.1MB
-
Filesize
1.5MB
-
Filesize
100KB
-
Filesize
572KB
-
Filesize
572KB
-
Filesize
152KB
-
Filesize
572KB
-
Filesize
1.1MB
-
Filesize
152KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
152KB
-
Filesize
572KB
-
Filesize
1.5MB
-
Filesize
140KB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
36KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
5.3MB
-
Filesize
628KB
-
Filesize
1024KB
-
Filesize
5.3MB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB