Analysis
-
max time kernel
2s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
07-01-2024 18:31
General
-
Target
aa5e9ff271143c3cd205988c3100f1bb844d70d2930f04a2b2002e9c0951a74e.exe
-
Size
2.9MB
-
MD5
e69948a6953a77464e92ac44fe945242
-
SHA1
d0b1569b0ca632defc74a6320658c0c1481f3ee1
-
SHA256
aa5e9ff271143c3cd205988c3100f1bb844d70d2930f04a2b2002e9c0951a74e
-
SHA512
f14f8a41c2e5dad21908eae3494cc1db049e223b19186379256695825b9918813e4cd34d73f43eba36fdfbfff6608d50bf2b98dbd45f17c4b3136bc6087c2952
-
SSDEEP
49152:xcBhEwJ84vLRaBtIl9mVJUv0E5ZpAR7px2jOT+lp4wC/+nDVHrP7gvUQI0QBJ:xbCvLUBsgI0gZpU7pcOT+rL+4JbWUQ8
Malware Config
Extracted
vidar
40.1
706
https://eduarroma.tumblr.com/
-
profile_id
706
Extracted
nullmixer
http://watira.xyz/
Extracted
smokeloader
2020
http://varmisende.com/upload/
http://fernandomayol.com/upload/
http://nextlytm.com/upload/
http://people4jan.com/upload/
http://asfaltwerk.com/upload/
Extracted
gozi
Signatures
-
Gozi
Gozi is a well-known and widely distributed banking trojan.
-
NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Vidar Stealer 4 IoCs
-
ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 11 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 6 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Runs regedit.exe 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa5e9ff271143c3cd205988c3100f1bb844d70d2930f04a2b2002e9c0951a74e.exe"C:\Users\Admin\AppData\Local\Temp\aa5e9ff271143c3cd205988c3100f1bb844d70d2930f04a2b2002e9c0951a74e.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0280F116\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS0280F116\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2080 -s 3442⤵
- Program crash
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0280F116\Sun21caad43cbccfb.exeSun21caad43cbccfb.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\is-EQCE6.tmp\Sun218856081dd1.tmp"C:\Users\Admin\AppData\Local\Temp\is-EQCE6.tmp\Sun218856081dd1.tmp" /SL5="$501F4,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS0280F116\Sun218856081dd1.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0280F116\Sun21dd3b887a3.exeSun21dd3b887a3.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2544 -s 5082⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 6243⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0280F116\Sun213b31a7e71d4cf6d.exeSun213b31a7e71d4cf6d.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0280F116\Sun21688b2b2b63.exeSun21688b2b2b63.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 9682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 6203⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0280F116\Sun218856081dd1.exeSun218856081dd1.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 4281⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\7zS0280F116\Sun21ab69e87d0.exeSun21ab69e87d0.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0280F116\Sun21cfc7686a.exeSun21cfc7686a.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0280F116\Sun211972de1e.exeSun211972de1e.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun213b31a7e71d4cf6d.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun21ab69e87d0.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun21dd3b887a3.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun218856081dd1.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun21688b2b2b63.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun21caad43cbccfb.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun21cfc7686a.exe1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun211972de1e.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\AAC0.exeC:\Users\Admin\AppData\Local\Temp\AAC0.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\i9e7aug5awg_1.exe/suac3⤵
-
C:\Windows\SysWOW64\regedit.exe"C:\Windows\SysWOW64\regedit.exe"4⤵
- Runs regedit.exe
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /SC ONLOGON /TN "Windows Update Check - 0x1BB70478" /TR "C:\PROGRA~3\JAVAUP~1\I9E7AU~1.EXE" /RL HIGHEST4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\BA5B.exeC:\Users\Admin\AppData\Local\Temp\BA5B.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
Filesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
Filesize
2.1MB
MD53303b0c75753ea25cf206b81ad24816b
SHA112a6265214cf693af00d14c3b720731abd20fd1e
SHA2564c1704c1b7f10a459017319b867377a68d67e194c692d46baa5d1fb233b50c59
SHA51297677fb7704d360e5e042c36bc8fb9bcfdbb93b3e966a20a4370ebd5c7527589f7ff4937fb75aaf9744e01a3db12000f0ba6e2027b673cb6538a986e6ed2a18f
-
Filesize
1.2MB
MD53dd12ac7d7646dc795a9f83a1319278f
SHA117524430bad533834c77efa2d100cc121eae2813
SHA256e62f966311737d05e1275d54ee409eabdd9504a171e0c213846679b63ff8c91b
SHA51291d28005630ee724922457f3a73ac04b3f70fd149aff0ccf456cd885024e1be7aff204cd6932c44173028b300320d505d937ab7bc9b1b6d276c250f6fd003ef1
-
Filesize
4KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
784KB
-
Filesize
1.5MB
-
Filesize
784KB
-
Filesize
1.5MB
-
Filesize
24KB
-
Filesize
1.5MB
-
Filesize
24KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
48KB
-
Filesize
1.5MB
-
Filesize
784KB
-
Filesize
1.5MB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
6.8MB
-
Filesize
84KB
-
Filesize
6.8MB
-
Filesize
4KB
-
Filesize
6.8MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
1.1MB
-
Filesize
25.9MB
-
Filesize
25.9MB
-
Filesize
628KB
-
Filesize
1024KB
-
Filesize
628KB
-
Filesize
1024KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
32KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
4KB
-
Filesize
48KB
-
Filesize
784KB
-
Filesize
52KB
-
Filesize
372KB
-
Filesize
408KB
-
Filesize
24KB
-
Filesize
4KB
-
Filesize
48KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
4KB
-
Filesize
408KB
-
Filesize
24KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
184KB
-
Filesize
9.9MB
-
Filesize
128KB
-
Filesize
36KB
-
Filesize
25.5MB
-
Filesize
36KB
-
Filesize
1024KB
-
Filesize
25.5MB
-
Filesize
100KB
-
Filesize
1.5MB
-
Filesize
572KB
-
Filesize
152KB
-
Filesize
572KB
-
Filesize
1.5MB
-
Filesize
152KB
-
Filesize
1.5MB
-
Filesize
572KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
572KB
-
Filesize
1.5MB
-
Filesize
152KB
-
Filesize
100KB
-
Filesize
140KB
-
Filesize
1.5MB
-
Filesize
784KB
-
Filesize
152KB
-
Filesize
572KB
-
Filesize
1.1MB
-
Filesize
152KB
-
Filesize
572KB
-
Filesize
784KB
-
Filesize
436KB
-
Filesize
436KB