Analysis
- max time kernel
0s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
07/01/2024, 18:26
General
- Target Samples 1/1f2a3d598734fe566de2054f3c73fd2245fc6023f0740bdbae88a076f508ebd2.exe
- Size 3.2MB
- Sample240107-w3ew5aceh9
- SHA256 1f2a3d598734fe566de2054f3c73fd2245fc6023f0740bdbae88a076f508ebd2
Malware Config
Extracted
-
nullmixer
-
http://hsiens.xyz/
Signatures
- NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Program crash 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Samples 1\1f2a3d598734fe566de2054f3c73fd2245fc6023f0740bdbae88a076f508ebd2.exe"C:\Users\Admin\AppData\Local\Temp\Samples 1\1f2a3d598734fe566de2054f3c73fd2245fc6023f0740bdbae88a076f508ebd2.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4631D057\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS4631D057\setup_install.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 4283⤵
- Program crash
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed07dd0f9237ae5d18.exe3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed07b581086d15e1327.exe3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed07aae78df723ca71.exe3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed07e3ab19adb60e5fe.exe3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed07f6275ab2b782.exe3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed07bdaa18ec852.exe3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed07383feb8d.exe3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed079f4562cd9c8.exe3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-7C0CB.tmp\Wed07bdaa18ec852.tmp"C:\Users\Admin\AppData\Local\Temp\is-7C0CB.tmp\Wed07bdaa18ec852.tmp" /SL5="$B0036,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS4631D057\Wed07bdaa18ec852.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 1052 -ip 10521⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4631D057\Wed079f4562cd9c8.exe"C:\Users\Admin\AppData\Local\Temp\7zS4631D057\Wed079f4562cd9c8.exe" -u1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4524 -ip 45241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 8241⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\7zS4631D057\Wed07e3ab19adb60e5fe.exeWed07e3ab19adb60e5fe.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4524 -ip 45241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 8441⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\7zS4631D057\Wed07aae78df723ca71.exeWed07aae78df723ca71.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4631D057\Wed07bdaa18ec852.exeWed07bdaa18ec852.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4524 -ip 45241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 8241⤵
- Program crash
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4631D057\Wed07dd0f9237ae5d18.exeWed07dd0f9237ae5d18.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4524 -ip 45241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 8641⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\7zS4631D057\Wed07b581086d15e1327.exeWed07b581086d15e1327.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4524 -ip 45241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 10401⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4524 -ip 45241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 10521⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\7zS4631D057\Wed079f4562cd9c8.exeWed079f4562cd9c8.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4631D057\Wed07383feb8d.exeWed07383feb8d.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 11202⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 15042⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 15362⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 15042⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 15322⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 16122⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 15362⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 17602⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 16122⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 16282⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4524 -ip 45241⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4631D057\Wed07f6275ab2b782.exeWed07f6275ab2b782.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4524 -ip 45241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4524 -ip 45241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4524 -ip 45241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4524 -ip 45241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4524 -ip 45241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4524 -ip 45241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4524 -ip 45241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4524 -ip 45241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4524 -ip 45241⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
setup_install.exe
memory/544-79-0x00007FF835EE0000-0x00007FF8369A1000-memory.dmp
memory/544-92-0x000000001B3D0000-0x000000001B3E0000-memory.dmp
memory/544-183-0x00007FF835EE0000-0x00007FF8369A1000-memory.dmp
memory/544-73-0x0000000000620000-0x0000000000628000-memory.dmp
memory/544-187-0x000000001B3D0000-0x000000001B3E0000-memory.dmp
memory/1052-48-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1052-53-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1052-49-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/1052-56-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1052-47-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1052-52-0x0000000064940000-0x0000000064959000-memory.dmp
memory/1052-46-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1052-58-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/1052-50-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1052-51-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1052-54-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1052-57-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/1052-55-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1052-118-0x0000000000400000-0x000000000051B000-memory.dmp
memory/1052-120-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/1052-122-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/1052-123-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1052-121-0x0000000064940000-0x0000000064959000-memory.dmp
memory/1052-119-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/3464-77-0x0000000000400000-0x000000000046D000-memory.dmp
memory/3464-133-0x0000000000400000-0x000000000046D000-memory.dmp
memory/3464-86-0x0000000000400000-0x000000000046D000-memory.dmp
memory/3616-172-0x0000000007B40000-0x0000000007B54000-memory.dmp
memory/3616-174-0x0000000007C20000-0x0000000007C28000-memory.dmp
memory/3616-90-0x0000000073490000-0x0000000073C40000-memory.dmp
memory/3616-125-0x00000000066C0000-0x000000000670C000-memory.dmp
memory/3616-91-0x00000000030B0000-0x00000000030C0000-memory.dmp
memory/3616-93-0x00000000030B0000-0x00000000030C0000-memory.dmp
memory/3616-163-0x00000000030B0000-0x00000000030C0000-memory.dmp
memory/3616-105-0x0000000005610000-0x0000000005632000-memory.dmp
memory/3616-116-0x0000000006200000-0x0000000006266000-memory.dmp
memory/3616-111-0x0000000005EF0000-0x0000000005F56000-memory.dmp
memory/3616-117-0x0000000006270000-0x00000000065C4000-memory.dmp
memory/3616-124-0x0000000005370000-0x000000000538E000-memory.dmp
memory/3616-177-0x0000000073490000-0x0000000073C40000-memory.dmp
memory/3616-165-0x0000000007900000-0x000000000791A000-memory.dmp
memory/3616-173-0x0000000007C30000-0x0000000007C4A000-memory.dmp
memory/3616-162-0x00000000075A0000-0x0000000007643000-memory.dmp
memory/3616-169-0x0000000007B30000-0x0000000007B3E000-memory.dmp
memory/3616-168-0x0000000007B00000-0x0000000007B11000-memory.dmp
memory/3616-167-0x0000000007B70000-0x0000000007C06000-memory.dmp
memory/3616-166-0x0000000007980000-0x000000000798A000-memory.dmp
memory/3616-164-0x0000000007F40000-0x00000000085BA000-memory.dmp
memory/3616-85-0x0000000005750000-0x0000000005D78000-memory.dmp
memory/3616-81-0x0000000002FF0000-0x0000000003026000-memory.dmp
memory/3616-150-0x0000000007560000-0x0000000007592000-memory.dmp
memory/3616-151-0x000000006FDA0000-0x000000006FDEC000-memory.dmp
memory/3616-161-0x0000000006B70000-0x0000000006B8E000-memory.dmp
memory/4176-129-0x0000000000400000-0x0000000000516000-memory.dmp
memory/4176-97-0x00000000005A0000-0x00000000005A1000-memory.dmp
memory/4488-88-0x0000000000D90000-0x0000000000DB0000-memory.dmp
memory/4488-171-0x00007FF835EE0000-0x00007FF8369A1000-memory.dmp
memory/4488-82-0x00000000005C0000-0x00000000005EE000-memory.dmp
memory/4488-84-0x00007FF835EE0000-0x00007FF8369A1000-memory.dmp
memory/4488-94-0x000000001B420000-0x000000001B430000-memory.dmp
memory/4524-194-0x00000000023C0000-0x00000000024C0000-memory.dmp
memory/4524-130-0x00000000023C0000-0x00000000024C0000-memory.dmp
memory/4524-181-0x0000000000400000-0x00000000021DA000-memory.dmp
memory/4524-135-0x0000000000400000-0x00000000021DA000-memory.dmp
memory/4524-132-0x0000000003E70000-0x0000000003F43000-memory.dmp
memory/4764-146-0x00000000065E0000-0x00000000065F0000-memory.dmp
memory/4764-137-0x00000000065F0000-0x0000000006B94000-memory.dmp
memory/4764-142-0x0000000006400000-0x000000000650A000-memory.dmp
memory/4764-140-0x0000000000400000-0x0000000001D9A000-memory.dmp
memory/4764-141-0x0000000003F60000-0x0000000003F72000-memory.dmp
memory/4764-134-0x0000000003C30000-0x0000000003C56000-memory.dmp
memory/4764-139-0x0000000006BA0000-0x00000000071B8000-memory.dmp
memory/4764-138-0x0000000003E10000-0x0000000003E34000-memory.dmp
memory/4764-148-0x00000000065E0000-0x00000000065F0000-memory.dmp
memory/4764-143-0x0000000073490000-0x0000000073C40000-memory.dmp
memory/4764-136-0x0000000001F20000-0x0000000001F50000-memory.dmp
memory/4764-149-0x00000000065E0000-0x00000000065F0000-memory.dmp
memory/4764-147-0x0000000001DE0000-0x0000000001EE0000-memory.dmp
memory/4764-145-0x0000000006510000-0x000000000654C000-memory.dmp
memory/4764-190-0x0000000073490000-0x0000000073C40000-memory.dmp
memory/4764-144-0x00000000065E0000-0x00000000065F0000-memory.dmp
memory/4764-195-0x00000000065E0000-0x00000000065F0000-memory.dmp
memory/4764-196-0x00000000065E0000-0x00000000065F0000-memory.dmp