Overview

overview

10

Static

static

3

8d67e92d16...58.exe

windows7-x64

10

8d67e92d16...58.exe

windows10-2004-x64

10

setup_installer.exe

windows7-x64

10

setup_installer.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    1s
  • max time network
    30s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/02/2024, 21:35

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    setup_installer.exe
  • Size 4.2MB
  • Sample240203-1fdg1aafd7
  • SHA256 5ad7bfb790fc652df60360024af60578790930bb78489aabf352eae3fff103fb
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
nullmixerprivateloaderaspackv2dropperloader

Malware Config

Extracted

Family

  • nullmixer

C2

  • http://marisana.xyz/

Signatures

  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    droppernullmixer
  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

    loaderprivateloader
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
    1⤵
      PID:2816
      • C:\Users\Admin\AppData\Local\Temp\7zS00B31107\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS00B31107\setup_install.exe"
        2⤵
          PID:3068
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Mon2008ca219fb.exe
            3⤵
              PID:2544
        • C:\Users\Admin\AppData\Local\Temp\7zS00B31107\Mon20b1a4b518b89f.exe
          Mon20b1a4b518b89f.exe
          1⤵
            PID:2848
          • C:\Users\Admin\AppData\Local\Temp\7zS00B31107\Mon20a820a0da875e5a5.exe
            Mon20a820a0da875e5a5.exe
            1⤵
              PID:2296
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
              1⤵
                PID:452
              • C:\Users\Admin\AppData\Local\Temp\7zS00B31107\Mon201e749cce13219c.exe
                Mon201e749cce13219c.exe
                1⤵
                  PID:4732
                • C:\Users\Admin\AppData\Local\Temp\7zS00B31107\Mon2028cde87b.exe
                  Mon2028cde87b.exe
                  1⤵
                    PID:4776
                  • C:\Users\Admin\AppData\Local\Temp\7zS00B31107\Mon20e066a4a15d1287.exe
                    Mon20e066a4a15d1287.exe
                    1⤵
                      PID:5024
                    • C:\Users\Admin\AppData\Local\Temp\7zS00B31107\Mon20bd52299e9f784e5.exe
                      Mon20bd52299e9f784e5.exe
                      1⤵
                        PID:4872

                      Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            Mon2008ca219fb.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\7zS00B31107\Mon2008ca219fb.exe
                            • Size 8KB
                            • SHA256 9a1f1a9f448d94c8954b8004a4ff3e8405f8b18139f95d04f8d9b40c483e1b40
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            Mon2028cde87b.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\7zS00B31107\Mon2028cde87b.exe
                            • Size 1KB
                            • SHA256 4f339b2757f6de515520bc4059171c31edf177f539859d8bff3ee7dd3967126a
                            • MD5 SHA1 SHA512
                            Submit Download

                            Mon2028cde87b.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\7zS00B31107\Mon2028cde87b.exe
                            • Size 64KB
                            • SHA256 ad719115e18effabfdb225e23c1d15cbcdef0c845c1a5d3b95ce53e53254423d
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            Mon20b1a4b518b89f.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\7zS00B31107\Mon20b1a4b518b89f.exe
                            • Size 149KB
                            • SHA256 e6caefaad33a55b32db653b63db879b7fd6746ef67347b6a99f9759bc741444f
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            Mon20bd1069e0a1.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\7zS00B31107\Mon20bd1069e0a1.exe
                            • Size 189KB
                            • SHA256 711e3611fd94103a5a20823410551c8af49a74da64016d635ea303f66970db83
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            Mon20bd52299e9f784e5.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\7zS00B31107\Mon20bd52299e9f784e5.exe
                            • Size 5KB
                            • SHA256 4e76b73ed9414224d13343aefa2133606c12843db6ab74df97447d7c5d810704
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            Mon20d164ee15b14251.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\7zS00B31107\Mon20d164ee15b14251.exe
                            • Size 2KB
                            • SHA256 d6c46733f6075c222ae12ebec0e5a9145a30fd4e938b54716372bca7219d611c
                            • MD5 SHA1 SHA512
                            Submit Download

                            Mon20e066a4a15d1287.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\7zS00B31107\Mon20e066a4a15d1287.exe
                            • Size 12KB
                            • SHA256 a8c5b84f001985bafd5deade02a1480b1dbd58da9c528bcb05ce9f270c4b79aa
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            libstdc++-6.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\7zS00B31107\libstdc++-6.dll
                            • Size 64KB
                            • SHA256 7d9113e74a2adf1c93adbe5c7936f2426d1bdacd21d8b724e83c23f6219d0064
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            libwinpthread-1.dll
                            • Path C:\Users\Admin\AppData\Local\Temp\7zS00B31107\libwinpthread-1.dll
                            • Size 41KB
                            • SHA256 3113d854de0b0ea1c00bae01d7ca9831060a5a8d11bba7a50239a6357dc838dd
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            setup_install.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\7zS00B31107\setup_install.exe
                            • Size 1.1MB
                            • SHA256 08ff31b2f73eedc6ce67589f7ac897ec79a23e7b6bdbdfc0ee7f71629bcfe29e
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            setup_install.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\7zS00B31107\setup_install.exe
                            • Size 352KB
                            • SHA256 81da044ef40d9eb4feb040717b5af0c3e118ce92f4f3abd9d7b76d2b4f9e15f6
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            setup_install.exe
                            • Path C:\Users\Admin\AppData\Local\Temp\7zS00B31107\setup_install.exe
                            • Size 27KB
                            • SHA256 d403fcec25694e079b77d8dbe6ec416441c9754964be824c4ed60efa29a1a733
                            • MD5 SHA1 SHA512 SSDEEP
                            Submit Download

                            memory/3068-62-0x000000006B280000-0x000000006B2A6000-memory.dmp
                            Download

                            memory/3068-63-0x000000006B280000-0x000000006B2A6000-memory.dmp
                            Download

                            memory/3068-54-0x0000000000D00000-0x0000000000D8F000-memory.dmp
                            Download

                            memory/3068-51-0x000000006B440000-0x000000006B4CF000-memory.dmp
                            Download