nullmixer | 1afe857d1b5f2c0ff48ebbd2f32abf11f9b310416b1273e77adc7ee37f001ff8

Analysis

max time kernel
0s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
07-01-2024 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Samples 1/1f2a3d598734fe566de2054f3c73fd2245fc6023f0740bdbae88a076f508ebd2.exe
Size

3.2MB
MD5

f23a2c6dfaeceefb067b42df7b09c2e5
SHA1

77f744dc208d542f438bae3dc97398c769dffc90
SHA256

1f2a3d598734fe566de2054f3c73fd2245fc6023f0740bdbae88a076f508ebd2
SHA512

9020004b0b77aaf9ee6b6429763c19b7a2360ee06835cb5bed9a1b724241752ac5f1c9013346bf8971d6dd217495e71b59ee423830e13f3c9dc1bdb6cced6028
SSDEEP

98304:xQCvLUBsgjDAzKDFW/1+Y6MojWEpww/CPJs:xtLUCg4QFi/olpww/CRs

Score

10^/10

nullmixer dropper

Malware Config

Extracted

Family

nullmixer

http://hsiens.xyz/

Signatures

NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
dropper nullmixer
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

21 ip-api.com

flow	ioc
21	ip-api.com

Program crash 17 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4332	1052	WerFault.exe	setup_install.exe
4576	4524	WerFault.exe
4208	4524	WerFault.exe
1960	4524	WerFault.exe
4608	4524	WerFault.exe
3712	4524	WerFault.exe
4340	4524	WerFault.exe
4040	4524	WerFault.exe	Wed07383feb8d.exe
2520	4524	WerFault.exe	Wed07383feb8d.exe
4432	4524	WerFault.exe	Wed07383feb8d.exe
4672	4524	WerFault.exe	Wed07383feb8d.exe
2280	4524	WerFault.exe	Wed07383feb8d.exe
4368	4524	WerFault.exe	Wed07383feb8d.exe
4796	4524	WerFault.exe	Wed07383feb8d.exe
1960	4524	WerFault.exe	Wed07383feb8d.exe
5204	4524	WerFault.exe	Wed07383feb8d.exe
5264	4524	WerFault.exe	Wed07383feb8d.exe

C:\Users\Admin\AppData\Local\Temp\Samples 1\1f2a3d598734fe566de2054f3c73fd2245fc6023f0740bdbae88a076f508ebd2.exe
"C:\Users\Admin\AppData\Local\Temp\Samples 1\1f2a3d598734fe566de2054f3c73fd2245fc6023f0740bdbae88a076f508ebd2.exe"
1⤵
PID:868

C:\Users\Admin\AppData\Local\Temp\7zS4631D057\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS4631D057\setup_install.exe"
2⤵
PID:1052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 428
3⤵
- Program crash
PID:4332

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Wed07dd0f9237ae5d18.exe
3⤵
PID:1676

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Wed07b581086d15e1327.exe
3⤵
PID:2252

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Wed07aae78df723ca71.exe
3⤵
PID:528

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Wed07e3ab19adb60e5fe.exe
3⤵
PID:920

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Wed07f6275ab2b782.exe
3⤵
PID:1140

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Wed07bdaa18ec852.exe
3⤵
PID:4280

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Wed07383feb8d.exe
3⤵
PID:744

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c Wed079f4562cd9c8.exe
3⤵
PID:4832

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
3⤵
PID:3384

C:\Users\Admin\AppData\Local\Temp\is-7C0CB.tmp\Wed07bdaa18ec852.tmp
"C:\Users\Admin\AppData\Local\Temp\is-7C0CB.tmp\Wed07bdaa18ec852.tmp" /SL5="$B0036,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS4631D057\Wed07bdaa18ec852.exe"
1⤵
PID:4176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 1052 -ip 1052
1⤵
PID:3896

C:\Users\Admin\AppData\Local\Temp\7zS4631D057\Wed079f4562cd9c8.exe
"C:\Users\Admin\AppData\Local\Temp\7zS4631D057\Wed079f4562cd9c8.exe" -u
1⤵
PID:944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4524 -ip 4524
1⤵
PID:4340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 824
1⤵
- Program crash
PID:4576

C:\Users\Admin\AppData\Local\Temp\7zS4631D057\Wed07e3ab19adb60e5fe.exe
Wed07e3ab19adb60e5fe.exe
1⤵
PID:4488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4524 -ip 4524
1⤵
PID:868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 844
1⤵
- Program crash
PID:4208

C:\Users\Admin\AppData\Local\Temp\7zS4631D057\Wed07aae78df723ca71.exe
Wed07aae78df723ca71.exe
1⤵
PID:4764

C:\Users\Admin\AppData\Local\Temp\7zS4631D057\Wed07bdaa18ec852.exe
Wed07bdaa18ec852.exe
1⤵
PID:3464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4524 -ip 4524
1⤵
PID:3604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 824
1⤵
- Program crash
PID:1960

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
1⤵
PID:3616

C:\Users\Admin\AppData\Local\Temp\7zS4631D057\Wed07dd0f9237ae5d18.exe
Wed07dd0f9237ae5d18.exe
1⤵
PID:544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4524 -ip 4524
1⤵
PID:1508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 864
1⤵
- Program crash
PID:4608

C:\Users\Admin\AppData\Local\Temp\7zS4631D057\Wed07b581086d15e1327.exe
Wed07b581086d15e1327.exe
1⤵
PID:856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4524 -ip 4524
1⤵
PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 1040
1⤵
- Program crash
PID:3712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4524 -ip 4524
1⤵
PID:3464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 1052
1⤵
- Program crash
PID:4340

C:\Users\Admin\AppData\Local\Temp\7zS4631D057\Wed079f4562cd9c8.exe
Wed079f4562cd9c8.exe
1⤵
PID:4688

C:\Users\Admin\AppData\Local\Temp\7zS4631D057\Wed07383feb8d.exe
Wed07383feb8d.exe
1⤵
PID:4524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 1120
2⤵
- Program crash
PID:4040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 1504
2⤵
- Program crash
PID:2520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 1536
2⤵
- Program crash
PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 1504
2⤵
- Program crash
PID:4672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 1532
2⤵
- Program crash
PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 1612
2⤵
- Program crash
PID:4368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 1536
2⤵
- Program crash
PID:4796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 1760
2⤵
- Program crash
PID:1960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 1612
2⤵
- Program crash
PID:5204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 1628
2⤵
- Program crash
PID:5264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4524 -ip 4524
1⤵
PID:4860

C:\Users\Admin\AppData\Local\Temp\7zS4631D057\Wed07f6275ab2b782.exe
Wed07f6275ab2b782.exe
1⤵
PID:4292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4524 -ip 4524
1⤵
PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4524 -ip 4524
1⤵
PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4524 -ip 4524
1⤵
PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4524 -ip 4524
1⤵
PID:3228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4524 -ip 4524
1⤵
PID:3604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4524 -ip 4524
1⤵
PID:3712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4524 -ip 4524
1⤵
PID:4340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4524 -ip 4524
1⤵
PID:5184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4524 -ip 4524
1⤵
PID:5244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS4631D057\setup_install.exe
Filesize
92KB

MD5
36ecb80835771cced2c5bc0196867d91

SHA1
c2eeae41a80811251f4ea5fe6af0fd89881e0123

SHA256
5c20c8c1be240cd2c145a6bba7a8a89b7fad21bccf03673a413db5909b4e6b78

SHA512
848e273643bbf68598de961554cb36e418057c314e4892e66189ef5ebe08d5e3125a65db3d61ee9f5317f8da2fe3b2979a2fb2318e7ede45ac09ff70bc61ffb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4631D057\setup_install.exe
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/544-79-0x00007FF835EE0000-0x00007FF8369A1000-memory.dmp

Filesize
10.8MB

Download
memory/544-92-0x000000001B3D0000-0x000000001B3E0000-memory.dmp

Filesize
64KB

Download
memory/544-183-0x00007FF835EE0000-0x00007FF8369A1000-memory.dmp

Filesize
10.8MB

Download
memory/544-73-0x0000000000620000-0x0000000000628000-memory.dmp

Filesize
32KB

Download
memory/544-187-0x000000001B3D0000-0x000000001B3E0000-memory.dmp

Filesize
64KB

Download
memory/1052-48-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1052-53-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1052-49-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1052-56-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1052-47-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1052-52-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1052-46-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1052-58-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1052-50-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/1052-51-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1052-54-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1052-57-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1052-55-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1052-118-0x0000000000400000-0x000000000051B000-memory.dmp

Filesize
1.1MB

Download
memory/1052-120-0x000000006B280000-0x000000006B2A6000-memory.dmp

Filesize
152KB

Download
memory/1052-122-0x000000006EB40000-0x000000006EB63000-memory.dmp

Filesize
140KB

Download
memory/1052-123-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Filesize
1.5MB

Download
memory/1052-121-0x0000000064940000-0x0000000064959000-memory.dmp

Filesize
100KB

Download
memory/1052-119-0x000000006B440000-0x000000006B4CF000-memory.dmp

Filesize
572KB

Download
memory/3464-77-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/3464-133-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/3464-86-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/3616-172-0x0000000007B40000-0x0000000007B54000-memory.dmp

Filesize
80KB

Download
memory/3616-174-0x0000000007C20000-0x0000000007C28000-memory.dmp

Filesize
32KB

Download
memory/3616-90-0x0000000073490000-0x0000000073C40000-memory.dmp

Filesize
7.7MB

Download
memory/3616-125-0x00000000066C0000-0x000000000670C000-memory.dmp

Filesize
304KB

Download
memory/3616-91-0x00000000030B0000-0x00000000030C0000-memory.dmp

Filesize
64KB

Download
memory/3616-93-0x00000000030B0000-0x00000000030C0000-memory.dmp

Filesize
64KB

Download
memory/3616-163-0x00000000030B0000-0x00000000030C0000-memory.dmp

Filesize
64KB

Download
memory/3616-105-0x0000000005610000-0x0000000005632000-memory.dmp

Filesize
136KB

Download
memory/3616-116-0x0000000006200000-0x0000000006266000-memory.dmp

Filesize
408KB

Download
memory/3616-111-0x0000000005EF0000-0x0000000005F56000-memory.dmp

Filesize
408KB

Download
memory/3616-117-0x0000000006270000-0x00000000065C4000-memory.dmp

Filesize
3.3MB

Download
memory/3616-124-0x0000000005370000-0x000000000538E000-memory.dmp

Filesize
120KB

Download
memory/3616-177-0x0000000073490000-0x0000000073C40000-memory.dmp

Filesize
7.7MB

Download
memory/3616-165-0x0000000007900000-0x000000000791A000-memory.dmp

Filesize
104KB

Download
memory/3616-173-0x0000000007C30000-0x0000000007C4A000-memory.dmp

Filesize
104KB

Download
memory/3616-162-0x00000000075A0000-0x0000000007643000-memory.dmp

Filesize
652KB

Download
memory/3616-169-0x0000000007B30000-0x0000000007B3E000-memory.dmp

Filesize
56KB

Download
memory/3616-168-0x0000000007B00000-0x0000000007B11000-memory.dmp

Filesize
68KB

Download
memory/3616-167-0x0000000007B70000-0x0000000007C06000-memory.dmp

Filesize
600KB

Download
memory/3616-166-0x0000000007980000-0x000000000798A000-memory.dmp

Filesize
40KB

Download
memory/3616-164-0x0000000007F40000-0x00000000085BA000-memory.dmp

Filesize
6.5MB

Download
memory/3616-85-0x0000000005750000-0x0000000005D78000-memory.dmp

Filesize
6.2MB

Download
memory/3616-81-0x0000000002FF0000-0x0000000003026000-memory.dmp

Filesize
216KB

Download
memory/3616-150-0x0000000007560000-0x0000000007592000-memory.dmp

Filesize
200KB

Download
memory/3616-151-0x000000006FDA0000-0x000000006FDEC000-memory.dmp

Filesize
304KB

Download
memory/3616-161-0x0000000006B70000-0x0000000006B8E000-memory.dmp

Filesize
120KB

Download
memory/4176-129-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download
memory/4176-97-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/4488-88-0x0000000000D90000-0x0000000000DB0000-memory.dmp

Filesize
128KB

Download
memory/4488-171-0x00007FF835EE0000-0x00007FF8369A1000-memory.dmp

Filesize
10.8MB

Download
memory/4488-82-0x00000000005C0000-0x00000000005EE000-memory.dmp

Filesize
184KB

Download
memory/4488-84-0x00007FF835EE0000-0x00007FF8369A1000-memory.dmp

Filesize
10.8MB

Download
memory/4488-94-0x000000001B420000-0x000000001B430000-memory.dmp

Filesize
64KB

Download
memory/4524-194-0x00000000023C0000-0x00000000024C0000-memory.dmp

Filesize
1024KB

Download
memory/4524-130-0x00000000023C0000-0x00000000024C0000-memory.dmp

Filesize
1024KB

Download
memory/4524-181-0x0000000000400000-0x00000000021DA000-memory.dmp

Filesize
29.9MB

Download
memory/4524-135-0x0000000000400000-0x00000000021DA000-memory.dmp

Filesize
29.9MB

Download
memory/4524-132-0x0000000003E70000-0x0000000003F43000-memory.dmp

Filesize
844KB

Download
memory/4764-146-0x00000000065E0000-0x00000000065F0000-memory.dmp

Filesize
64KB

Download
memory/4764-137-0x00000000065F0000-0x0000000006B94000-memory.dmp

Filesize
5.6MB

Download
memory/4764-142-0x0000000006400000-0x000000000650A000-memory.dmp

Filesize
1.0MB

Download
memory/4764-140-0x0000000000400000-0x0000000001D9A000-memory.dmp

Filesize
25.6MB

Download
memory/4764-141-0x0000000003F60000-0x0000000003F72000-memory.dmp

Filesize
72KB

Download
memory/4764-134-0x0000000003C30000-0x0000000003C56000-memory.dmp

Filesize
152KB

Download
memory/4764-139-0x0000000006BA0000-0x00000000071B8000-memory.dmp

Filesize
6.1MB

Download
memory/4764-138-0x0000000003E10000-0x0000000003E34000-memory.dmp

Filesize
144KB

Download
memory/4764-148-0x00000000065E0000-0x00000000065F0000-memory.dmp

Filesize
64KB

Download
memory/4764-143-0x0000000073490000-0x0000000073C40000-memory.dmp

Filesize
7.7MB

Download
memory/4764-136-0x0000000001F20000-0x0000000001F50000-memory.dmp

Filesize
192KB

Download
memory/4764-149-0x00000000065E0000-0x00000000065F0000-memory.dmp

Filesize
64KB

Download
memory/4764-147-0x0000000001DE0000-0x0000000001EE0000-memory.dmp

Filesize
1024KB

Download
memory/4764-145-0x0000000006510000-0x000000000654C000-memory.dmp

Filesize
240KB

Download
memory/4764-190-0x0000000073490000-0x0000000073C40000-memory.dmp

Filesize
7.7MB

Download
memory/4764-144-0x00000000065E0000-0x00000000065F0000-memory.dmp

Filesize
64KB

Download
memory/4764-195-0x00000000065E0000-0x00000000065F0000-memory.dmp

Filesize
64KB

Download
memory/4764-196-0x00000000065E0000-0x00000000065F0000-memory.dmp

Filesize
64KB

Download