Resubmissions

03-01-2024 09:53

240103-lwpsmsfbf2 10

31-12-2023 07:08

231231-hyjgvschfl 10

Analysis

  • max time kernel
    0s
  • max time network
    120s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-01-2024 09:53

General

  • Target

    2ccaeaf721c1ae29a84714ee5aca4f02.exe

  • Size

    5.7MB

  • MD5

    2ccaeaf721c1ae29a84714ee5aca4f02

  • SHA1

    c6b1a42e7dcf10aa81f76e8a9ea18b1ca1fd9037

  • SHA256

    088559f2192fe04ad85f83e1a3ac931f2bdbb5a88b4146154858d00c40b4b551

  • SHA512

    c00750ec16ac21a640f2e39952dede04bb975ae276f8a4ca30c78e6c8c2783d8eb4dabc499588b7f72c35cd16737f8abf871f48188271d8a8c6c1f740be09aa9

  • SSDEEP

    98304:xmCvLUBsgU0L6mf8dNC1hmxxQwZ6xYQ2TZy+O1tkEdTBGg8VWzVw:xPLUCgUkJYxxUV25+tkJg+WzW

Malware Config

Extracted

Family

nullmixer

C2

http://marisana.xyz/

Extracted

Family

vidar

Version

40

Botnet

706

C2

https://lenak513.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family

smokeloader

Botnet

pub6

Extracted

Family

smokeloader

Version

2020

C2

http://aucmoney.com/upload/

http://thegymmum.com/upload/

http://atvcampingtrips.com/upload/

http://kuapakualaman.com/upload/

http://renatazarazua.com/upload/

http://nasufmutlu.com/upload/

rc4.i32
rc4.i32

Signatures

  • Detect ZGRat V1 1 IoCs
  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Vidar Stealer 3 IoCs
  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • Amadey 6 IoCs

    amadey_bot.

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 3 IoCs

    test.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2ccaeaf721c1ae29a84714ee5aca4f02.exe
    "C:\Users\Admin\AppData\Local\Temp\2ccaeaf721c1ae29a84714ee5aca4f02.exe"
    1⤵
      PID:1052
      • C:\Users\Admin\AppData\Local\Temp\7zSC14A5A27\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zSC14A5A27\setup_install.exe"
        2⤵
          PID:2852
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c 79d822fc709e78.exe
            3⤵
              PID:3584
              • C:\Users\Admin\AppData\Local\Temp\7zSC14A5A27\79d822fc709e78.exe
                79d822fc709e78.exe
                4⤵
                  PID:1548
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2852 -s 588
                3⤵
                • Program crash
                PID:3176
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c b001a8f56.exe
                3⤵
                  PID:1732
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c 2d7080268fee447.exe
                  3⤵
                    PID:1900
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c f9a302645.exe
                    3⤵
                      PID:3424
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c 3d0c613fcb2403.exe
                      3⤵
                        PID:1920
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c e9e6055abb695524.exe
                        3⤵
                          PID:1148
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c 20383e5a9a4c5112.exe
                          3⤵
                            PID:3508
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c 27ce46284501.exe
                            3⤵
                              PID:4964
                        • C:\Users\Admin\AppData\Local\Temp\7zSC14A5A27\2d7080268fee447.exe
                          2d7080268fee447.exe
                          1⤵
                            PID:2392
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2852 -ip 2852
                            1⤵
                              PID:2020
                            • C:\Users\Admin\AppData\Local\Temp\7zSC14A5A27\e9e6055abb695524.exe
                              "C:\Users\Admin\AppData\Local\Temp\7zSC14A5A27\e9e6055abb695524.exe" -a
                              1⤵
                                PID:4464
                              • C:\Users\Admin\AppData\Local\Temp\7zSC14A5A27\20383e5a9a4c5112.exe
                                20383e5a9a4c5112.exe
                                1⤵
                                  PID:1104
                                • C:\Users\Admin\AppData\Local\Temp\7zSC14A5A27\27ce46284501.exe
                                  27ce46284501.exe
                                  1⤵
                                    PID:4588
                                  • C:\Users\Admin\AppData\Local\Temp\7zSC14A5A27\3d0c613fcb2403.exe
                                    3d0c613fcb2403.exe
                                    1⤵
                                      PID:676
                                    • C:\Users\Admin\AppData\Local\Temp\7zSC14A5A27\f9a302645.exe
                                      f9a302645.exe
                                      1⤵
                                        PID:2276
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 2276 -s 372
                                          2⤵
                                          • Program crash
                                          PID:3452
                                      • C:\Users\Admin\AppData\Local\Temp\7zSC14A5A27\e9e6055abb695524.exe
                                        e9e6055abb695524.exe
                                        1⤵
                                          PID:1084
                                        • C:\Users\Admin\AppData\Local\Temp\7zSC14A5A27\b001a8f56.exe
                                          b001a8f56.exe
                                          1⤵
                                            PID:4832
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 1576
                                              2⤵
                                              • Program crash
                                              PID:4572
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2276 -ip 2276
                                            1⤵
                                              PID:4240
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4832 -ip 4832
                                              1⤵
                                                PID:4852

                                              Network

                                              MITRE ATT&CK Enterprise v15

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\Users\Admin\AppData\Local\Temp\7zSC14A5A27\setup_install.exe

                                                Filesize

                                                381KB

                                                MD5

                                                6cba3fc79f15b2fa16466518feb8ccfd

                                                SHA1

                                                6780744b3d026db256a160e969e82fe45bf2b0fb

                                                SHA256

                                                d247da9cc2437b73bd5c06a1c7269564838c6c81af3cbec25a13d9e88186f119

                                                SHA512

                                                e070cf1661d4027e075b5a9fea318ad02f6935229dc3e4307913dc5a08d9a7554db29eabede38e7a9d8ac33ba1aa84aa24f7dba0275a9b920bb11368d3e7452e

                                              • C:\Users\Admin\AppData\Local\Temp\7zSC14A5A27\setup_install.exe

                                                Filesize

                                                92KB

                                                MD5

                                                8457a6a66e87533e9deab3979c868266

                                                SHA1

                                                6b8cdda8e73323e91ad3b0181f516ca4897b23a5

                                                SHA256

                                                41f63e586bb2b67408d43ab6849fcfd1d1f7b19571eeae1d6be043c5b2fc702f

                                                SHA512

                                                00e4c39df83f6f55fa6132b98d9f09c84d2c66e1173b73d2876d1a50803d237a248e7605ab2ba23eebf5e77b9ce7604f795cfc460f0bb5f3f06334394ab4baec

                                              • C:\Users\Admin\AppData\Local\Temp\7zSC14A5A27\setup_install.exe

                                                MD5

                                                d41d8cd98f00b204e9800998ecf8427e

                                                SHA1

                                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                SHA256

                                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                SHA512

                                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                              • memory/1104-105-0x0000000002C30000-0x0000000002C36000-memory.dmp

                                                Filesize

                                                24KB

                                              • memory/1104-124-0x000000001BA00000-0x000000001BA10000-memory.dmp

                                                Filesize

                                                64KB

                                              • memory/1104-100-0x0000000002C00000-0x0000000002C22000-memory.dmp

                                                Filesize

                                                136KB

                                              • memory/1104-90-0x0000000000C70000-0x0000000000C9E000-memory.dmp

                                                Filesize

                                                184KB

                                              • memory/1104-95-0x0000000002BF0000-0x0000000002BF6000-memory.dmp

                                                Filesize

                                                24KB

                                              • memory/1104-89-0x00007FFF49F10000-0x00007FFF4A9D1000-memory.dmp

                                                Filesize

                                                10.8MB

                                              • memory/2276-138-0x0000000000400000-0x00000000032F8000-memory.dmp

                                                Filesize

                                                47.0MB

                                              • memory/2276-103-0x00000000001C0000-0x00000000001C9000-memory.dmp

                                                Filesize

                                                36KB

                                              • memory/2276-115-0x0000000003640000-0x0000000003740000-memory.dmp

                                                Filesize

                                                1024KB

                                              • memory/2276-110-0x0000000000400000-0x00000000032F8000-memory.dmp

                                                Filesize

                                                47.0MB

                                              • memory/2392-87-0x0000000002DD0000-0x0000000002DE0000-memory.dmp

                                                Filesize

                                                64KB

                                              • memory/2392-79-0x00007FFF49F10000-0x00007FFF4A9D1000-memory.dmp

                                                Filesize

                                                10.8MB

                                              • memory/2392-75-0x0000000000E30000-0x0000000000E38000-memory.dmp

                                                Filesize

                                                32KB

                                              • memory/2392-140-0x00007FFF49F10000-0x00007FFF4A9D1000-memory.dmp

                                                Filesize

                                                10.8MB

                                              • memory/2392-145-0x0000000002DD0000-0x0000000002DE0000-memory.dmp

                                                Filesize

                                                64KB

                                              • memory/2852-117-0x0000000064940000-0x0000000064959000-memory.dmp

                                                Filesize

                                                100KB

                                              • memory/2852-30-0x0000000000F00000-0x0000000000F8F000-memory.dmp

                                                Filesize

                                                572KB

                                              • memory/2852-120-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                Filesize

                                                572KB

                                              • memory/2852-122-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                Filesize

                                                1.5MB

                                              • memory/2852-121-0x000000006EB40000-0x000000006EB63000-memory.dmp

                                                Filesize

                                                140KB

                                              • memory/2852-32-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                Filesize

                                                572KB

                                              • memory/2852-37-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                Filesize

                                                1.5MB

                                              • memory/2852-43-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                Filesize

                                                152KB

                                              • memory/2852-41-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                Filesize

                                                1.5MB

                                              • memory/2852-114-0x0000000000400000-0x0000000000C7F000-memory.dmp

                                                Filesize

                                                8.5MB

                                              • memory/2852-29-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                Filesize

                                                152KB

                                              • memory/2852-42-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                Filesize

                                                152KB

                                              • memory/2852-33-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                Filesize

                                                572KB

                                              • memory/2852-119-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                Filesize

                                                152KB

                                              • memory/2852-35-0x0000000064940000-0x0000000064959000-memory.dmp

                                                Filesize

                                                100KB

                                              • memory/2852-34-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                Filesize

                                                572KB

                                              • memory/2852-36-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                Filesize

                                                572KB

                                              • memory/2852-38-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                Filesize

                                                1.5MB

                                              • memory/2852-39-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                Filesize

                                                1.5MB

                                              • memory/2852-40-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                Filesize

                                                1.5MB

                                              • memory/3484-125-0x0000000002750000-0x0000000002766000-memory.dmp

                                                Filesize

                                                88KB

                                              • memory/4588-102-0x00000000007B0000-0x0000000000FD6000-memory.dmp

                                                Filesize

                                                8.1MB

                                              • memory/4588-113-0x00000000775F4000-0x00000000775F6000-memory.dmp

                                                Filesize

                                                8KB

                                              • memory/4588-94-0x00000000759A0000-0x0000000075A90000-memory.dmp

                                                Filesize

                                                960KB

                                              • memory/4588-84-0x00000000007B0000-0x0000000000FD6000-memory.dmp

                                                Filesize

                                                8.1MB

                                              • memory/4588-99-0x00000000759A0000-0x0000000075A90000-memory.dmp

                                                Filesize

                                                960KB

                                              • memory/4588-106-0x0000000005FC0000-0x00000000065D8000-memory.dmp

                                                Filesize

                                                6.1MB

                                              • memory/4588-91-0x00000000759A0000-0x0000000075A90000-memory.dmp

                                                Filesize

                                                960KB

                                              • memory/4588-107-0x00000000058F0000-0x0000000005902000-memory.dmp

                                                Filesize

                                                72KB

                                              • memory/4588-97-0x00000000759A0000-0x0000000075A90000-memory.dmp

                                                Filesize

                                                960KB

                                              • memory/4588-108-0x0000000005950000-0x000000000598C000-memory.dmp

                                                Filesize

                                                240KB

                                              • memory/4588-101-0x00000000759A0000-0x0000000075A90000-memory.dmp

                                                Filesize

                                                960KB

                                              • memory/4588-154-0x00000000759A0000-0x0000000075A90000-memory.dmp

                                                Filesize

                                                960KB

                                              • memory/4588-112-0x00000000759A0000-0x0000000075A90000-memory.dmp

                                                Filesize

                                                960KB

                                              • memory/4588-109-0x00000000059A0000-0x00000000059EC000-memory.dmp

                                                Filesize

                                                304KB

                                              • memory/4588-92-0x00000000759A0000-0x0000000075A90000-memory.dmp

                                                Filesize

                                                960KB

                                              • memory/4588-98-0x00000000759A0000-0x0000000075A90000-memory.dmp

                                                Filesize

                                                960KB

                                              • memory/4588-150-0x00000000759A0000-0x0000000075A90000-memory.dmp

                                                Filesize

                                                960KB

                                              • memory/4588-151-0x00000000759A0000-0x0000000075A90000-memory.dmp

                                                Filesize

                                                960KB

                                              • memory/4588-118-0x0000000005B50000-0x0000000005C5A000-memory.dmp

                                                Filesize

                                                1.0MB

                                              • memory/4588-141-0x00000000007B0000-0x0000000000FD6000-memory.dmp

                                                Filesize

                                                8.1MB

                                              • memory/4588-146-0x00000000759A0000-0x0000000075A90000-memory.dmp

                                                Filesize

                                                960KB

                                              • memory/4588-152-0x00000000759A0000-0x0000000075A90000-memory.dmp

                                                Filesize

                                                960KB

                                              • memory/4588-144-0x00000000759A0000-0x0000000075A90000-memory.dmp

                                                Filesize

                                                960KB

                                              • memory/4588-143-0x00000000759A0000-0x0000000075A90000-memory.dmp

                                                Filesize

                                                960KB

                                              • memory/4588-153-0x00000000759A0000-0x0000000075A90000-memory.dmp

                                                Filesize

                                                960KB

                                              • memory/4832-123-0x0000000000400000-0x000000000334B000-memory.dmp

                                                Filesize

                                                47.3MB

                                              • memory/4832-116-0x00000000035C0000-0x00000000036C0000-memory.dmp

                                                Filesize

                                                1024KB

                                              • memory/4832-137-0x0000000000400000-0x000000000334B000-memory.dmp

                                                Filesize

                                                47.3MB

                                              • memory/4832-111-0x0000000003460000-0x00000000034FD000-memory.dmp

                                                Filesize

                                                628KB