Analysis
-
max time kernel
0s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
31-12-2023 12:19
General
-
Target
35f16297325ed756df16be1282b64ad3.exe
-
Size
3.2MB
-
MD5
35f16297325ed756df16be1282b64ad3
-
SHA1
2676e2d8f9e336c0e63032a2d4cf8516e94a7ebc
-
SHA256
208660089575dbef9e473ae2b2556e5492e8739376d39e1f5575ca65d33892f7
-
SHA512
343749ffa07857a7da87dc11e563070bca628078464048f1a9b9b1b6c62374c14b66b69bcdadfb3d4ac18db2e52ed5ac56da8941b0f53e2d2f84e0bd38ab1c85
-
SSDEEP
49152:EgqRTT9SaYrgC87+Z9CNph1NghUYiHuqJieZLS8QdUMT/axADmf/U:J+TpDfVTXiAuUieZrQdalf/U
Malware Config
Extracted
smokeloader
pub6
Extracted
vidar
39.4
706
https://sergeevih43.tumblr.com/
-
profile_id
706
Extracted
nullmixer
http://motiwa.xyz/
Extracted
redline
ServAni
87.251.71.195:82
Extracted
smokeloader
2020
http://ppcspb.com/upload/
http://mebbing.com/upload/
http://twcamel.com/upload/
http://howdycash.com/upload/
http://lahuertasonora.com/upload/
http://kpotiques.com/upload/
Signatures
-
Detect Fabookie payload 1 IoCs
-
Fabookie
Fabookie is facebook account info stealer.
-
NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
-
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 3 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Nirsoft 3 IoCs
-
Vidar Stealer 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\35f16297325ed756df16be1282b64ad3.exe"C:\Users\Admin\AppData\Local\Temp\35f16297325ed756df16be1282b64ad3.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_5.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSC563AF06\arnatic_5.exearnatic_5.exe2⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_7.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSC563AF06\arnatic_7.exearnatic_7.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSC563AF06\arnatic_7.exeC:\Users\Admin\AppData\Local\Temp\7zSC563AF06\arnatic_7.exe3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSC563AF06\arnatic_3.exearnatic_3.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 4081⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\7zSC563AF06\arnatic_1.exearnatic_1.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 9642⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC563AF06\arnatic_2.exearnatic_2.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSC563AF06\arnatic_4.exearnatic_4.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC563AF06\arnatic_6.exearnatic_6.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_6.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_4.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_3.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_2.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_1.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSC563AF06\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSC563AF06\setup_install.exe"1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
Filesize
242B
MD516b1a570ab2b9ec4249224bbe05a1d46
SHA1faa8480b7cbbc416aabebc43c8fd3b9a96103c95
SHA2561fe676ddfd2bcfa6434c7fab5a99f939178cf98de6d78f52ff3cb1b3707ad99e
SHA5126e5089d82d64de95351cde7c800849675e1f6a4801ddea2615232b514e88eab7e93fe3564cd4aa9b6f48b67426704f4e0a8bcd96e6e6734fdcf0c5bee5b89ea4
-
Filesize
174KB
MD5f12aa4983f77ed85b3a618f7656807c2
SHA1ab29f2221d590d03756d89e63cf2802ee31ecbcf
SHA2565db1d9e50f0e0e0ba0b15920e65a1b9e3b61bcc03d5930870e0b226b600a72e2
SHA5129074af27996a11e988be7147cf387d8952b515d070ff49fec22f0e5b2d374563204eda56319447d9b5f49f056be1475f0a1a2c501fdf1a769d7d8a8077ccba8b
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
786B
MD5397daf9c26a53e504bdcea8172b77d54
SHA1500679165f82d67c421c77d518a4e5146cd4154e
SHA2560ba938c2342d7a19afb1e9eb31c4d24903a253ba72eaf7d844b30ee6802cf07b
SHA5121ebec6639ee5edfa200451347c91e2ef07ce3b701f750656d7d39cdf1a869d08c1c3d236a457a02a3712adb467004d7de9bf98c7565f5ed58bed031214543009
-
Filesize
184KB
MD57fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
Filesize
61KB
MD5a6279ec92ff948760ce53bba817d6a77
SHA15345505e12f9e4c6d569a226d50e71b5a572dce2
SHA2568b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
SHA512213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c
-
Filesize
893KB
MD5448a932608dc3baae923e5ff52123284
SHA1bb964dc3346a6c0305f48cac7aed5d795e894434
SHA256eb2afe97c80ce482cce0cec9b4128162bb64cda3087173605a50cb1f8a82dd3e
SHA512ceb71111e8db7a15ea62bb315408f0e838ffc3468a0d5624fb486b0e45f32628078eb93153243a34d5856d473ae43c2f5e3b09549ccdc59d4cbde4b88e6f2720
-
Filesize
687KB
MD50f99dc5341325b390015f874459cfd09
SHA1456e80ba2709b75f457190bec5a9a99e55b8d426
SHA2561d90c36363b0932531e90e75ff792707f70469c0845b90952d85232ab8cb7f9a
SHA51260cff6a393549472524d3f546f99b2319c144b53a92a026e284d9a69a7edce9b0e2405eef8fff957ccfb09b32803145367d85d06d5548e0017c36e8da1fd7b40
-
Filesize
345KB
MD5c7880ac5df740670d0c382f3e991d4ec
SHA155301d8e6b2322018939a1f42a301d0220961d1c
SHA256ea20142400d1fbacdaa7e76afe34e2847b6b290cdb8afc13558bb29c172efcdc
SHA512f2245cb5eb30f7bed0830a14370173d6c893c6091c2b422f419a2a7e720f4e4bcb3aa88a137db2e215f7217faf580a3a69a318095d1dc05107d8b58f8950c3a9
-
Filesize
972KB
MD55668cb771643274ba2c375ec6403c266
SHA1dd78b03428b99368906fe62fc46aaaf1db07a8b9
SHA256d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384
SHA512135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a
-
Filesize
773KB
MD5a0b06be5d5272aa4fcf2261ed257ee06
SHA1596c955b854f51f462c26b5eb94e1b6161aad83c
SHA256475d0beeadca13ecdfd905c840297e53ad87731dc911b324293ee95b3d8b700b
SHA5121eb6b9df145b131d03224e9bb7ed3c6cc87044506d848be14d3e4c70438e575dbbd2a0964b176281b1307469872bd6404873974475cd91eb6f7534d16ceff702
-
Filesize
380KB
MD5b0486bfc2e579b49b0cacee12c52469c
SHA1ac6eb40cc66eddd0589eb940e6a6ce06b00c7d30
SHA2569057ba81960258a882dee4335d947f499adabfc59bfd99e2b5f56b508a01fbe2
SHA512b7f55e346830e2a2ed99bd57bfd0cb66221675a6b0b23d35e5d7fac5eee0c3dfc771eed5fed410c2063410e048fe41765c880ebf0a48137f9135cf1d65951075
-
Filesize
48KB
MD589c739ae3bbee8c40a52090ad0641d31
SHA1d0f7dc9a0a3e52af0f9f9736f26e401636c420a1
SHA25610a122bd647c88aa23f96687e26b251862e83be9dbb89532f4a578689547972d
SHA512cc5059e478e5f469fde39e4119ee75eed7066f2a2069590cb5046e478b812f87ab1fc21dcfe44c965061fa4f9f83d6a14accf0c0e9b2406ae51504d06a3f6480
-
Filesize
1.4MB
MD52838d8ac46afe98fae3b8cf2694f6c5c
SHA1d0c622a69ad17da211e3ad96386c02f584aaca70
SHA2561ff69c6cd3ddcecdccd4908b54c5b5c0c96013db3b0db1ea913b532395df7da6
SHA5127e61596b850ba095eb7468c99fdcfa8710f9aadf67e729dee83d2d267c77800ffe1f3f90088ce328581ccd53c9d500bcbf077547006e59e169e5e02b79cedeb5
-
Filesize
304KB
-
Filesize
452KB
-
Filesize
452KB
-
Filesize
304KB
-
Filesize
452KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
452KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
88KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
4KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
408KB
-
Filesize
1024KB
-
Filesize
5.0MB
-
Filesize
36KB
-
Filesize
5.0MB
-
Filesize
1.1MB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
136KB
-
Filesize
5.3MB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
1024KB
-
Filesize
5.3MB
-
Filesize
1024KB
-
Filesize
372KB
-
Filesize
1.0MB
-
Filesize
24KB
-
Filesize
9.9MB
-
Filesize
208KB
-
Filesize
24KB
-
Filesize
9.9MB
-
Filesize
160KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
1.5MB
-
Filesize
1.1MB
-
Filesize
1.5MB
-
Filesize
572KB
-
Filesize
572KB
-
Filesize
152KB
-
Filesize
152KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.5MB
-
Filesize
1.1MB
-
Filesize
140KB
-
Filesize
152KB
-
Filesize
100KB
-
Filesize
1.1MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.5MB
-
Filesize
1.1MB
-
Filesize
152KB
-
Filesize
572KB
-
Filesize
1.1MB
-
Filesize
572KB
-
Filesize
152KB
-
Filesize
572KB
-
Filesize
100KB
-
Filesize
364KB
-
Filesize
364KB