Analysis
- max time kernel
150s - max time network
150s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
28/02/2024, 03:07
General
- Target setup_installer.exe
- Size 3.3MB
- Sample240228-dmex3saa24
- SHA256 787c2734ffd8d3faa404896595d75ef6806edfbfd1f059e4a242dcba086f67a4
Malware Config
Extracted
-
nullmixer
-
http://watira.xyz/
Extracted
-
ffdroider
-
http://186.2.171.3
Extracted
-
smokeloader
-
pub5
Extracted
-
vidar
-
40
-
706
-
https://lenak513.tumblr.com/
-
profile_id
706
Extracted
-
smokeloader
-
2020
-
http://aucmoney.com/upload/
-
http://thegymmum.com/upload/
-
http://atvcampingtrips.com/upload/
-
http://kuapakualaman.com/upload/
-
http://renatazarazua.com/upload/
-
http://nasufmutlu.com/upload/
Signatures
- FFDroider
Stealer targeting social media platform users first seen in April 2022.
- FFDroider payload 3 IoCs
- NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
- PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Vidar Stealer 2 IoCs
- ASPack v2.12-2.42 3 IoCs
Detects executables packed with ASPack v2.12-2.42
- Executes dropped EXE 11 IoCs
- Loads dropped DLL 50 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- VMProtect packed file 5 IoCs
Detects executables packed with VMProtect commercial packer.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Modifies system certificate store 2 TTPs 14 IoCs
- Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS478F3506\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS478F3506\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c61317e0d33fd92.exe3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS478F3506\c61317e0d33fd92.exec61317e0d33fd92.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cc9c4e191.exe3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS478F3506\cc9c4e191.execc9c4e191.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c d879501442ad4.exe3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS478F3506\d879501442ad4.exed879501442ad4.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 12d60c3323e093.exe3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS478F3506\12d60c3323e093.exe12d60c3323e093.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 1e97cf058.exe3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS478F3506\1e97cf058.exe1e97cf058.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 7c5d969bb386.exe3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS478F3506\7c5d969bb386.exe7c5d969bb386.exe4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c APPNAME77.exe3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c f43b7f406819e5.exe3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS478F3506\f43b7f406819e5.exef43b7f406819e5.exe4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 773e151d8f03fcc9.exe3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS478F3506\773e151d8f03fcc9.exe773e151d8f03fcc9.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2716 -s 9685⤵
- Loads dropped DLL
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 4243⤵
- Loads dropped DLL
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-EO7H6.tmp\cc9c4e191.tmp"C:\Users\Admin\AppData\Local\Temp\is-EO7H6.tmp\cc9c4e191.tmp" /SL5="$40174,138429,56832,C:\Users\Admin\AppData\Local\Temp\7zS478F3506\cc9c4e191.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\7zS478F3506\1e97cf058.exe"C:\Users\Admin\AppData\Local\Temp\7zS478F3506\1e97cf058.exe" -a1⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
94308059B57B3142E455B38A6EB92015
12d60c3323e093.exe
773e151d8f03fcc9.exe
7c5d969bb386.exe
c61317e0d33fd92.exe
d879501442ad4.exe
f43b7f406819e5.exe
libcurl.dll
libcurlpp.dll
libgcc_s_dw2-1.dll
libstdc++-6.dll
libwinpthread-1.dll
setup_install.exe
Cab4395.tmp
Tar44A1.tmp
cc9c4e191.tmp
1e97cf058.exe
773e151d8f03fcc9.exe
c61317e0d33fd92.exe
cc9c4e191.exe
d879501442ad4.exe
setup_install.exe
setup_install.exe
setup_install.exe
setup_install.exe
_shfoldr.dll
memory/108-116-0x0000000000400000-0x0000000000759000-memory.dmp
memory/108-397-0x0000000000400000-0x0000000000759000-memory.dmp
memory/108-388-0x0000000000DB0000-0x0000000001109000-memory.dmp
memory/108-162-0x0000000000DB0000-0x0000000001109000-memory.dmp
memory/108-163-0x0000000000DB0000-0x0000000001109000-memory.dmp
memory/108-161-0x0000000000400000-0x0000000000759000-memory.dmp
memory/792-95-0x0000000000400000-0x0000000000414000-memory.dmp
memory/792-204-0x0000000000400000-0x0000000000414000-memory.dmp
memory/1176-272-0x0000000002DE0000-0x0000000002DF6000-memory.dmp
memory/1444-134-0x00000000003A0000-0x00000000003DC000-memory.dmp
memory/1444-285-0x00000000003A0000-0x00000000003DC000-memory.dmp
memory/1444-284-0x0000000000400000-0x00000000004BD000-memory.dmp
memory/1972-278-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/1972-281-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1972-42-0x0000000064940000-0x0000000064959000-memory.dmp
memory/1972-40-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1972-41-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1972-44-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1972-33-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1972-49-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1972-50-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/1972-51-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/1972-280-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/1972-48-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1972-279-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1972-47-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1972-46-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1972-39-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1972-277-0x0000000064940000-0x0000000064959000-memory.dmp
memory/1972-31-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/1972-276-0x0000000000400000-0x0000000000875000-memory.dmp
memory/1972-52-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2124-273-0x0000000000400000-0x0000000000907000-memory.dmp
memory/2124-171-0x00000000009D0000-0x0000000000AD0000-memory.dmp
memory/2124-201-0x0000000000400000-0x0000000000907000-memory.dmp
memory/2124-199-0x0000000000250000-0x0000000000259000-memory.dmp
memory/2716-159-0x0000000000960000-0x00000000009FD000-memory.dmp
memory/2716-200-0x0000000000400000-0x000000000095B000-memory.dmp
memory/2716-386-0x0000000000AB0000-0x0000000000BB0000-memory.dmp
memory/2716-148-0x0000000000AB0000-0x0000000000BB0000-memory.dmp
memory/2756-371-0x000007FEF5BE0000-0x000007FEF65CC000-memory.dmp
memory/2756-135-0x00000000004D0000-0x00000000004D6000-memory.dmp
memory/2756-137-0x00000000004E0000-0x0000000000502000-memory.dmp
memory/2756-203-0x000000001AF50000-0x000000001AFD0000-memory.dmp
memory/2756-147-0x000007FEF5BE0000-0x000007FEF65CC000-memory.dmp
memory/2756-118-0x0000000001180000-0x00000000011B2000-memory.dmp
memory/2756-145-0x0000000000500000-0x0000000000506000-memory.dmp
memory/2776-146-0x000007FEF5BE0000-0x000007FEF65CC000-memory.dmp
memory/2776-379-0x000007FEF5BE0000-0x000007FEF65CC000-memory.dmp
memory/2776-120-0x0000000001140000-0x0000000001148000-memory.dmp
memory/2776-389-0x000000001AF30000-0x000000001AFB0000-memory.dmp
memory/2776-202-0x000000001AF30000-0x000000001AFB0000-memory.dmp
memory/2924-160-0x0000000002AF0000-0x0000000002E49000-memory.dmp
memory/2924-387-0x0000000002AF0000-0x0000000002E49000-memory.dmp