Analysis
- max time kernel
152s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
26/01/2024, 22:02
General
- Target 788045d291dccd0c7bdf32e1d8e2ae51.exe
- Size 4.2MB
- Sample240126-1x5mtafcc3
- SHA256 5ad7bfb790fc652df60360024af60578790930bb78489aabf352eae3fff103fb
Malware Config
Extracted
-
nullmixer
-
http://marisana.xyz/
Extracted
-
redline
-
pab3
-
185.215.113.15:61506
Extracted
-
smokeloader
-
pub6
Extracted
-
vidar
-
40
-
706
-
https://lenak513.tumblr.com/
-
profile_id
706
Extracted
-
smokeloader
-
2020
-
http://aucmoney.com/upload/
-
http://thegymmum.com/upload/
-
http://atvcampingtrips.com/upload/
-
http://kuapakualaman.com/upload/
-
http://renatazarazua.com/upload/
-
http://nasufmutlu.com/upload/
Signatures
- CryptBot
A C++ stealer distributed widely in bundle with other software.
- CryptBot payload 3 IoCs
- NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
- PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 4 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Vidar Stealer 3 IoCs
- ASPack v2.12-2.42 3 IoCs
Detects executables packed with ASPack v2.12-2.42
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 13 IoCs
- Loads dropped DLL 6 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 11 IoCs
- Checks SCSI registry key(s) 3 TTPs 15 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 4 IoCs
- Modifies data under HKEY_USERS 54 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 41 IoCs
- Suspicious use of SendNotifyMessage 16 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\788045d291dccd0c7bdf32e1d8e2ae51.exe"C:\Users\Admin\AppData\Local\Temp\788045d291dccd0c7bdf32e1d8e2ae51.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4A178757\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS4A178757\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon20bd1069e0a1.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4A178757\Mon20bd1069e0a1.exeMon20bd1069e0a1.exe4⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon2008ca219fb.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4A178757\Mon2008ca219fb.exeMon2008ca219fb.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 5403⤵
- Program crash
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon20e066a4a15d1287.exe3⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon20bd52299e9f784e5.exe3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon2028cde87b.exe3⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon20d164ee15b14251.exe3⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon20a820a0da875e5a5.exe3⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon20b1a4b518b89f.exe3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon201e749cce13219c.exe3⤵
- Suspicious use of WriteProcessMemory
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS4A178757\Mon20e066a4a15d1287.exeMon20e066a4a15d1287.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Conservava.xlam2⤵
-
C:\Windows\SysWOW64\cmd.execmd3⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^aXXPLdOdpKvHEwwcALYIInWmgGDtBFsVVodqfjpjFmFfheNjFpLslXxTwbAyMJPDzALcKwugCMepSGkjSsms$" Suoi.xlam4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Talune.exe.comTalune.exe.com K4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Talune.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Talune.exe.com K5⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Windows\SysWOW64\PING.EXEping VFMDDVWB -n 304⤵
- Runs ping.exe
-
-
-
-
C:\Windows\SysWOW64\dllhost.exedllhost.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7zS4A178757\Mon20bd52299e9f784e5.exeMon20bd52299e9f784e5.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4A178757\Mon20b1a4b518b89f.exeMon20b1a4b518b89f.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\7zS4A178757\Mon2028cde87b.exeMon2028cde87b.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1848 -ip 18481⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4A178757\Mon20d164ee15b14251.exeMon20d164ee15b14251.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\7zS4A178757\Mon20a820a0da875e5a5.exeMon20a820a0da875e5a5.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 8322⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 8242⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 8802⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 8882⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 9202⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 10842⤵
- Executes dropped EXE
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 14922⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 15322⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 17802⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 10482⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\7zS4A178757\Mon201e749cce13219c.exe"C:\Users\Admin\AppData\Local\Temp\7zS4A178757\Mon201e749cce13219c.exe" -a1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2288 -ip 22881⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4A178757\Mon201e749cce13219c.exeMon201e749cce13219c.exe1⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2288 -ip 22881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2288 -ip 22881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2288 -ip 22881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2288 -ip 22881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2288 -ip 22881⤵
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 026cc2308e1121e91b601e18806fa7ea omhD2tZp+kO5f+xsf0C1wg.0.1.0.0.01⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2288 -ip 22881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2288 -ip 22881⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2288 -ip 22881⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2288 -ip 22881⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Mon2008ca219fb.exe
Mon201e749cce13219c.exe
Mon2028cde87b.exe
Mon2028cde87b.exe
Mon20a820a0da875e5a5.exe
Mon20a820a0da875e5a5.exe
Mon20b1a4b518b89f.exe
Mon20bd1069e0a1.exe
Mon20bd52299e9f784e5.exe
Mon20d164ee15b14251.exe
Mon20e066a4a15d1287.exe
Mon20e066a4a15d1287.exe
libcurl.dll
libcurlpp.dll
libgcc_s_dw2-1.dll
libstdc++-6.dll
libwinpthread-1.dll
setup_install.exe
setup_install.exe
setup_install.exe
Cercare.xlam
Conservava.xlam
K
Passaggio.xlam
Suoi.xlam
Talune.exe.com
Talune.exe.com
Talune.exe.com
RestartPop.txt
_Information.txt
_Information.txt
_Information.txt
_Screen_Desktop.jpeg
system_info.txt
system_info.txt
system_info.txt
kHZZi8npHt.zip
__PSScriptPolicyTest_xuk1wg0o.qmq.ps1
memory/1200-123-0x00000000047C0000-0x00000000047C9000-memory.dmp
memory/1200-148-0x0000000000400000-0x0000000002CBE000-memory.dmp
memory/1200-158-0x0000000000400000-0x0000000002CBE000-memory.dmp
memory/1200-121-0x0000000002CF0000-0x0000000002DF0000-memory.dmp
memory/1252-182-0x0000000007280000-0x000000000729A000-memory.dmp
memory/1252-180-0x00000000074E0000-0x0000000007583000-memory.dmp
memory/1252-187-0x0000000007790000-0x00000000077A4000-memory.dmp
memory/1252-186-0x0000000007780000-0x000000000778E000-memory.dmp
memory/1252-185-0x0000000007750000-0x0000000007761000-memory.dmp
memory/1252-110-0x0000000005450000-0x0000000005472000-memory.dmp
memory/1252-184-0x00000000077C0000-0x0000000007856000-memory.dmp
memory/1252-112-0x0000000004E50000-0x0000000004E60000-memory.dmp
memory/1252-114-0x0000000005B30000-0x0000000005B96000-memory.dmp
memory/1252-183-0x00000000075D0000-0x00000000075DA000-memory.dmp
memory/1252-87-0x0000000002C50000-0x0000000002C86000-memory.dmp
memory/1252-102-0x0000000005490000-0x0000000005AB8000-memory.dmp
memory/1252-181-0x0000000007C10000-0x000000000828A000-memory.dmp
memory/1252-100-0x0000000004E50000-0x0000000004E60000-memory.dmp
memory/1252-122-0x0000000005C10000-0x0000000005C76000-memory.dmp
memory/1252-189-0x0000000007870000-0x0000000007878000-memory.dmp
memory/1252-138-0x0000000072990000-0x0000000073140000-memory.dmp
memory/1252-166-0x00000000067F0000-0x0000000006822000-memory.dmp
memory/1252-130-0x0000000005D80000-0x00000000060D4000-memory.dmp
memory/1252-168-0x000000006E970000-0x000000006E9BC000-memory.dmp
memory/1252-178-0x00000000067D0000-0x00000000067EE000-memory.dmp
memory/1252-167-0x000000007EF80000-0x000000007EF90000-memory.dmp
memory/1252-164-0x0000000004E50000-0x0000000004E60000-memory.dmp
memory/1252-188-0x0000000007880000-0x000000000789A000-memory.dmp
memory/1252-147-0x0000000006230000-0x000000000624E000-memory.dmp
memory/1252-192-0x0000000072990000-0x0000000073140000-memory.dmp
memory/1848-142-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/1848-57-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1848-137-0x0000000000400000-0x000000000051B000-memory.dmp
memory/1848-141-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1848-60-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1848-139-0x0000000064940000-0x0000000064959000-memory.dmp
memory/1848-143-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/1848-144-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1848-62-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/1848-51-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1848-52-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1848-46-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1848-53-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1848-59-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1848-58-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1848-61-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/1848-55-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/1848-56-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1848-54-0x0000000064940000-0x0000000064959000-memory.dmp
memory/2288-133-0x0000000000400000-0x0000000002D1A000-memory.dmp
memory/2288-129-0x0000000004AA0000-0x0000000004B3D000-memory.dmp
memory/2288-128-0x0000000002ED0000-0x0000000002FD0000-memory.dmp
memory/2288-193-0x0000000000400000-0x0000000002D1A000-memory.dmp
memory/3352-156-0x00000000032B0000-0x00000000032C6000-memory.dmp
memory/4320-216-0x00000000056E0000-0x0000000005783000-memory.dmp
memory/4320-217-0x00000000056E0000-0x0000000005783000-memory.dmp
memory/4320-215-0x00000000056E0000-0x0000000005783000-memory.dmp
memory/4320-220-0x00000000056E0000-0x0000000005783000-memory.dmp
memory/4320-219-0x00000000056E0000-0x0000000005783000-memory.dmp
memory/4320-218-0x00000000056E0000-0x0000000005783000-memory.dmp
memory/5012-146-0x00007FFE240D0000-0x00007FFE24B91000-memory.dmp
memory/5012-101-0x000000001B530000-0x000000001B54C000-memory.dmp
memory/5012-85-0x0000000000970000-0x0000000000994000-memory.dmp
memory/5012-97-0x00007FFE240D0000-0x00007FFE24B91000-memory.dmp
memory/5012-136-0x000000001B420000-0x000000001B430000-memory.dmp
memory/5016-86-0x00007FFE240D0000-0x00007FFE24B91000-memory.dmp
memory/5016-111-0x000000001B2F0000-0x000000001B300000-memory.dmp
memory/5016-207-0x000000001B2F0000-0x000000001B300000-memory.dmp
memory/5016-82-0x00000000007A0000-0x00000000007A8000-memory.dmp
memory/5076-210-0x00000000073F0000-0x0000000007400000-memory.dmp
memory/5076-106-0x00000000072F0000-0x0000000007302000-memory.dmp
memory/5076-108-0x0000000000400000-0x0000000002CD3000-memory.dmp
memory/5076-209-0x0000000002DA0000-0x0000000002EA0000-memory.dmp
memory/5076-134-0x00000000073F0000-0x0000000007400000-memory.dmp
memory/5076-104-0x0000000004C30000-0x0000000004C50000-memory.dmp
memory/5076-103-0x0000000007400000-0x00000000079A4000-memory.dmp
memory/5076-99-0x0000000002D70000-0x0000000002D9F000-memory.dmp
memory/5076-105-0x00000000079B0000-0x0000000007FC8000-memory.dmp
memory/5076-208-0x00000000073F0000-0x0000000007400000-memory.dmp
memory/5076-98-0x0000000002DA0000-0x0000000002EA0000-memory.dmp
memory/5076-120-0x0000000007370000-0x00000000073BC000-memory.dmp
memory/5076-96-0x0000000004B90000-0x0000000004BB2000-memory.dmp
memory/5076-113-0x00000000073F0000-0x0000000007400000-memory.dmp
memory/5076-149-0x00000000073F0000-0x0000000007400000-memory.dmp
memory/5076-132-0x00000000081F0000-0x00000000082FA000-memory.dmp
memory/5076-135-0x00000000073F0000-0x0000000007400000-memory.dmp
memory/5076-107-0x0000000007310000-0x000000000734C000-memory.dmp
memory/5076-140-0x0000000072990000-0x0000000073140000-memory.dmp