Analysis
-
max time kernel
0s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
03-01-2024 09:53
Static task
static1
General
-
Target
2ccaeaf721c1ae29a84714ee5aca4f02.exe
-
Size
5.7MB
-
MD5
2ccaeaf721c1ae29a84714ee5aca4f02
-
SHA1
c6b1a42e7dcf10aa81f76e8a9ea18b1ca1fd9037
-
SHA256
088559f2192fe04ad85f83e1a3ac931f2bdbb5a88b4146154858d00c40b4b551
-
SHA512
c00750ec16ac21a640f2e39952dede04bb975ae276f8a4ca30c78e6c8c2783d8eb4dabc499588b7f72c35cd16737f8abf871f48188271d8a8c6c1f740be09aa9
-
SSDEEP
98304:xmCvLUBsgU0L6mf8dNC1hmxxQwZ6xYQ2TZy+O1tkEdTBGg8VWzVw:xPLUCgUkJYxxUV25+tkJg+WzW
Malware Config
Extracted
nullmixer
http://marisana.xyz/
Extracted
vidar
40
706
https://lenak513.tumblr.com/
-
profile_id
706
Extracted
smokeloader
pub6
Extracted
smokeloader
2020
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
Signatures
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2932-123-0x0000000001350000-0x0000000001B76000-memory.dmp family_zgrat_v1 -
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar Stealer 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2540-127-0x0000000003350000-0x00000000033ED000-memory.dmp family_vidar behavioral1/memory/2540-128-0x0000000000400000-0x000000000334B000-memory.dmp family_vidar behavioral1/memory/2540-270-0x0000000000400000-0x000000000334B000-memory.dmp family_vidar -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zSC8548D36\libcurl.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zSC8548D36\libcurlpp.dll aspack_v212_v242 -
Executes dropped EXE 3 IoCs
Processes:
setup_install.exe3d0c613fcb2403.exe27ce46284501.exepid process 1696 setup_install.exe 1984 3d0c613fcb2403.exe 2932 27ce46284501.exe -
Loads dropped DLL 17 IoCs
Processes:
2ccaeaf721c1ae29a84714ee5aca4f02.exesetup_install.execmd.execmd.execmd.execmd.execmd.exepid process 1420 2ccaeaf721c1ae29a84714ee5aca4f02.exe 1420 2ccaeaf721c1ae29a84714ee5aca4f02.exe 1420 2ccaeaf721c1ae29a84714ee5aca4f02.exe 1696 setup_install.exe 1696 setup_install.exe 1696 setup_install.exe 1696 setup_install.exe 1696 setup_install.exe 1696 setup_install.exe 1696 setup_install.exe 1696 setup_install.exe 2812 cmd.exe 2508 cmd.exe 2616 cmd.exe 2616 cmd.exe 2552 cmd.exe 2452 cmd.exe -
Processes:
resource yara_rule behavioral1/memory/2932-123-0x0000000001350000-0x0000000001B76000-memory.dmp themida -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 5 ipinfo.io 8 ipinfo.io 41 api.db-ip.com 42 api.db-ip.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1904 1696 WerFault.exe setup_install.exe 2992 2540 WerFault.exe b001a8f56.exe -
Amadey 8 IoCs
amadey_bot.
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\7zSC8548D36\setup_install.exe amadey_bot C:\Users\Admin\AppData\Local\Temp\7zSC8548D36\setup_install.exe amadey_bot \Users\Admin\AppData\Local\Temp\7zSC8548D36\setup_install.exe amadey_bot behavioral1/memory/2540-128-0x0000000000400000-0x000000000334B000-memory.dmp amadey_bot C:\Users\Admin\AppData\Local\Temp\7zSC8548D36\setup_install.exe amadey_bot \Users\Admin\AppData\Local\Temp\7zSC8548D36\setup_install.exe amadey_bot behavioral1/memory/2540-270-0x0000000000400000-0x000000000334B000-memory.dmp amadey_bot behavioral1/memory/1696-263-0x0000000000400000-0x0000000000C7F000-memory.dmp amadey_bot -
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 3 IoCs
test.
Processes:
resource yara_rule behavioral1/memory/2540-127-0x0000000003350000-0x00000000033ED000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/2540-128-0x0000000000400000-0x000000000334B000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral1/memory/2540-270-0x0000000000400000-0x000000000334B000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2ccaeaf721c1ae29a84714ee5aca4f02.exesetup_install.execmd.exedescription pid process target process PID 1420 wrote to memory of 1696 1420 2ccaeaf721c1ae29a84714ee5aca4f02.exe setup_install.exe PID 1420 wrote to memory of 1696 1420 2ccaeaf721c1ae29a84714ee5aca4f02.exe setup_install.exe PID 1420 wrote to memory of 1696 1420 2ccaeaf721c1ae29a84714ee5aca4f02.exe setup_install.exe PID 1420 wrote to memory of 1696 1420 2ccaeaf721c1ae29a84714ee5aca4f02.exe setup_install.exe PID 1420 wrote to memory of 1696 1420 2ccaeaf721c1ae29a84714ee5aca4f02.exe setup_install.exe PID 1420 wrote to memory of 1696 1420 2ccaeaf721c1ae29a84714ee5aca4f02.exe setup_install.exe PID 1420 wrote to memory of 1696 1420 2ccaeaf721c1ae29a84714ee5aca4f02.exe setup_install.exe PID 1696 wrote to memory of 2552 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2552 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2552 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2552 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2552 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2552 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2552 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2812 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2812 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2812 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2812 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2812 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2812 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2812 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2616 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2616 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2616 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2616 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2616 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2616 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2616 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2508 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2508 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2508 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2508 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2508 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2508 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2508 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2784 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2784 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2784 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2784 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2784 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2784 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2784 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2452 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2452 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2452 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2452 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2452 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2452 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2452 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2464 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2464 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2464 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2464 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2464 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2464 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2464 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2496 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2496 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2496 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2496 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2496 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2496 1696 setup_install.exe cmd.exe PID 1696 wrote to memory of 2496 1696 setup_install.exe cmd.exe PID 2508 wrote to memory of 1984 2508 cmd.exe 3d0c613fcb2403.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ccaeaf721c1ae29a84714ee5aca4f02.exe"C:\Users\Admin\AppData\Local\Temp\2ccaeaf721c1ae29a84714ee5aca4f02.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\7zSC8548D36\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSC8548D36\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 79d822fc709e78.exe3⤵PID:2496
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c b001a8f56.exe3⤵PID:2464
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 2d7080268fee447.exe3⤵
- Loads dropped DLL
PID:2452 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 4163⤵
- Program crash
PID:1904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c f9a302645.exe3⤵PID:2784
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 3d0c613fcb2403.exe3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c e9e6055abb695524.exe3⤵
- Loads dropped DLL
PID:2616 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 20383e5a9a4c5112.exe3⤵
- Loads dropped DLL
PID:2812 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 27ce46284501.exe3⤵
- Loads dropped DLL
PID:2552
-
C:\Users\Admin\AppData\Local\Temp\7zSC8548D36\b001a8f56.exeb001a8f56.exe1⤵PID:2540
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2540 -s 9522⤵
- Program crash
PID:2992
-
C:\Users\Admin\AppData\Local\Temp\7zSC8548D36\e9e6055abb695524.exe"C:\Users\Admin\AppData\Local\Temp\7zSC8548D36\e9e6055abb695524.exe" -a1⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\7zSC8548D36\f9a302645.exef9a302645.exe1⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\7zSC8548D36\79d822fc709e78.exe79d822fc709e78.exe1⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\7zSC8548D36\2d7080268fee447.exe2d7080268fee447.exe1⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\7zSC8548D36\27ce46284501.exe27ce46284501.exe1⤵
- Executes dropped EXE
PID:2932
-
C:\Users\Admin\AppData\Local\Temp\7zSC8548D36\e9e6055abb695524.exee9e6055abb695524.exe1⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\7zSC8548D36\3d0c613fcb2403.exe3d0c613fcb2403.exe1⤵
- Executes dropped EXE
PID:1984
-
C:\Users\Admin\AppData\Local\Temp\7zSC8548D36\20383e5a9a4c5112.exe20383e5a9a4c5112.exe1⤵PID:2528
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
Filesize
91KB
MD5fe7a6e06e1a017a850c91d7e7cb1da88
SHA1c934a16c045f6ce19b1e66ccfc8429b788149ed0
SHA256cdbf69614c711b0a7e6de6385cdc6d3ec0f68f7d3459ceabb4993b8d06106db3
SHA512add7908cbfad50babc1fe1bf91a3aa30308bb221d4412b698ec126338d89af2de19fbb0821e1b139516537fee0d44ef8cc2667b64d40017ef023eff4e12cf4cd
-
Filesize
1024KB
MD595160c9e0e414a07b0383c3a75aa5e8e
SHA15c71bddc8f1a9d433e5018fab60158ad2546456c
SHA25604497209f70b041f30e188ccef6b1dd0a8e602b8a27b6a03e83412c18dc4ced2
SHA512ba78f7c02b8ee9ee71526a3ecbc07dcdf3aa7ec9d12718a077340ff8256f72e41b205f44073ff84343b3ff5d8fe163a423256630a503fbcd4bf1980bc18451d8
-
Filesize
2.9MB
MD5340c3a811b8c6310f7ee327eb3d6c3cd
SHA18c8c0bdde42b3f25a512ff5d0e7bd8af4ff2d984
SHA2561e21112c24642ab0b471fe6b7a92cf1f52c4206e5fbc0569fa53f0dbbbfb045c
SHA512da2cb85824e2032d6500133204dbe4749a510d3a186b82b30fde3d25ff6670d65f4e58293bd7b9e1adb5170445e0a2142003acbd5c8ba164491c820a79159714
-
Filesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
Filesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
Filesize
1.0MB
MD52356e7051e8df1fc9da33fa713da888b
SHA140848282543e6465b806808083d4c43ed758f4de
SHA25628fed1cf112c498bd9cb512ea236871f1c99aa943fe9a255d1b8605d89e33535
SHA512304efdf9a5196e7bc1417945fade0579e6b60f6e6e91416ff92494718f99c1d9e1c3c8cd6c131ab5167be55bf569ea68dc607acb0d45b1d9125eae7048db8dcc
-
Filesize
246KB
MD5f9b5fcc1c168a777b42922b8e88afdb8
SHA137000a879ea2a9fb0bc080f7ff453b721fd30a0c
SHA256ef73c7d2020a1ad695009c8b52b977861eee23a4167c8845528fb9a477a812a0
SHA512080147911e93c06d3090e84c1f0ff5c7e4810beb40bdac7010bcea89f9064cbb8c7b56b2d96e07a6cc73c9934ca93d06d8fa06794c04e8d5fd11908b24e4397e
-
Filesize
3.4MB
MD55a951a3c08a6d8a99127cf56bed45815
SHA162627dfc47de5383a61870d8f758a65d7c42b238
SHA256b31a36b57a138bfda51b4bdc4dd3dc3d5541b5f76459d7c4a9bf95000ca8e5dc
SHA512899603f30152b4ba63f317ba27fc66c9bd30233a97a1c8023ed116058f5eeedacc579423f197beeee3994f2533de200f3f1c3f3bfdba4d1bfca3c3ee12ef97ce