Overview

overview

10

Static

static

3

e6ea98b046...1).exe

windows10-2004-x64

10

e6ea98b046...1).exe

windows7-x64

10

e6ea98b046...1).exe

windows10-1703-x64

10

e6ea98b046...1).exe

windows10-2004-x64

10

e6ea98b046...1).exe

windows11-21h2-x64

10

setup_installer.exe

windows10-1703-x64

10

setup_installer.exe

windows7-x64

10

setup_installer.exe

windows10-1703-x64

10

setup_installer.exe

windows10-2004-x64

10

setup_installer.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    1200s
  • max time network
    841s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    03-03-2024 21:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    setup_installer.exe

  • Size

    1.5MB

  • MD5

    78418bfb23c7adf70828f675e990de49

  • SHA1

    534a26817c39972287abf166bb00c831440a1e57

  • SHA256

    b14218cb639c6afa35a66cf418035ce10475b53f5386896a44327fd48d8447c8

  • SHA512

    5df88e9bd4d241b69acba4499845e68286cd24fffed582864c24ad4c5d9bd47041c99ac32cc023c7a6dbe4cecaed39882274cbf4e12aedd5220c6e51075a8dd8

  • SSDEEP

    24576:xcVkKSqXCeomdCFDWHp/7F82H1qjUEPY/RQ5DsvLwcaBhdZIl9mTkPdei+uYvSm1:xcBFCpZgu2VqjUEwJ84vLRaBtIl9mT4Y

Score
10/10
nullmixersmokeloaderpub6aspackv2backdoordropperevasionspywarestealertrojan

Malware Config

Extracted

Family

nullmixer

C2

http://wxkeww.xyz/

Extracted

Family

smokeloader

Botnet

pub6

Extracted

Family

smokeloader

Version

2020

C2

http://conceitosseg.com/upload/

http://integrasidata.com/upload/

http://ozentekstil.com/upload/

http://finbelportal.com/upload/

http://telanganadigital.com/upload/
rc4.i32
rc4.i32

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs
    evasiontrojan
  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

    droppernullmixer
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 29 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2820
    • C:\Users\Admin\AppData\Local\Temp\7zS40BCF406\setup_install.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS40BCF406\setup_install.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2932
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c karotima_1.exe
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2436
        • C:\Users\Admin\AppData\Local\Temp\7zS40BCF406\karotima_1.exe
          karotima_1.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies system certificate store
          PID:2860
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c karotima_2.exe
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2432
        • C:\Users\Admin\AppData\Local\Temp\7zS40BCF406\karotima_2.exe
          karotima_2.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks SCSI registry key(s)
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          PID:2032
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 368
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:2024
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {AE29834B-129E-4B14-A4A6-177DAE650E38} S-1-5-21-2721934792-624042501-2768869379-1000:BISMIZHX\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1104
    • C:\Users\Admin\AppData\Roaming\gbsssjw
      C:\Users\Admin\AppData\Roaming\gbsssjw
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2912
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2912 -s 124
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:644
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:1808
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {9B1E0DB7-21EE-4A35-AE59-B48D57F9FCF7} S-1-5-21-2721934792-624042501-2768869379-1000:BISMIZHX\Admin:Interactive:[1]
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1572
      • C:\Users\Admin\AppData\Roaming\gbsssjw
        C:\Users\Admin\AppData\Roaming\gbsssjw
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks SCSI registry key(s)
        • Suspicious behavior: MapViewOfSection
        PID:2760

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
      Filesize

      67KB

      MD5

      753df6889fd7410a2e9fe333da83a429

      SHA1

      3c425f16e8267186061dd48ac1c77c122962456e

      SHA256

      b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

      SHA512

      9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\7zS40BCF406\karotima_1.txt
      Filesize

      1.0MB

      MD5

      9108ad5775c76cccbb4eadf02de24f5d

      SHA1

      82996bc4f72b3234536d0b58630d5d26bcf904b0

      SHA256

      c9d5525b2f2b76087121039ee1c23ed35508e60f653479722ec64ea3a064878e

      SHA512

      19021a28555bba1fe1bdcdc8845f1bcadebd256c7db02b9329d6b44ae01a123a00e162cc34a97ba51f088cafa6f54ab1de8f82f771ac54b94a3a796f84f73362

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\7zS40BCF406\karotima_2.txt
      Filesize

      222KB

      MD5

      80e74cf9f38c5712c6c2432a509c8bc7

      SHA1

      62ccdca04b3685728ce7f1a785cc01f3a3f3b3dc

      SHA256

      9ff44c4da853cdbe606d2cfe4d04b410c3ae603acf0f1d3f75195b6236e0e123

      SHA512

      d602cd95ad38cacae41b4848e72ac54ad81d287e1c825d68a088009512b14b5290a5a6c3032ebb2c91fecb5f743d519e92f1ccb27f5fe2841094a693d2b8de49

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\7zS40BCF406\libcurl.dll
      Filesize

      218KB

      MD5

      d09be1f47fd6b827c81a4812b4f7296f

      SHA1

      028ae3596c0790e6d7f9f2f3c8e9591527d267f7

      SHA256

      0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

      SHA512

      857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\7zS40BCF406\libcurlpp.dll
      Filesize

      54KB

      MD5

      e6e578373c2e416289a8da55f1dc5e8e

      SHA1

      b601a229b66ec3d19c2369b36216c6f6eb1c063e

      SHA256

      43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

      SHA512

      9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\7zS40BCF406\libstdc++-6.dll
      Filesize

      600KB

      MD5

      b42b68f0728382abbef1b3794bd06d9d

      SHA1

      d8db15bab29849f77b067c914098614a175309bd

      SHA256

      ddf50c713857e8bd26659a1076f33185223c5540ccb6254bdb737b5ca37a03b9

      SHA512

      e8bccc3e551696b467d6625071710bd8a7243935884d014ecb321e5f97e7d968a90bfb19a580ae20459347cba7d25b424ea2adacdc1781a829c388fc9bd20421

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Tar31A2.tmp
      Filesize

      175KB

      MD5

      dd73cead4b93366cf3465c8cd32e2796

      SHA1

      74546226dfe9ceb8184651e920d1dbfb432b314e

      SHA256

      a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

      SHA512

      ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

      Download Submit

    • \Users\Admin\AppData\Local\Temp\7zS40BCF406\libgcc_s_dw2-1.dll
      Filesize

      113KB

      MD5

      9aec524b616618b0d3d00b27b6f51da1

      SHA1

      64264300801a353db324d11738ffed876550e1d3

      SHA256

      59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

      SHA512

      0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

      Download Submit

    • \Users\Admin\AppData\Local\Temp\7zS40BCF406\libstdc++-6.dll
      Filesize

      647KB

      MD5

      5e279950775baae5fea04d2cc4526bcc

      SHA1

      8aef1e10031c3629512c43dd8b0b5d9060878453

      SHA256

      97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

      SHA512

      666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

      Download Submit

    • \Users\Admin\AppData\Local\Temp\7zS40BCF406\libwinpthread-1.dll
      Filesize

      69KB

      MD5

      1e0d62c34ff2e649ebc5c372065732ee

      SHA1

      fcfaa36ba456159b26140a43e80fbd7e9d9af2de

      SHA256

      509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

      SHA512

      3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

      Download Submit

    • \Users\Admin\AppData\Local\Temp\7zS40BCF406\setup_install.exe
      Filesize

      290KB

      MD5

      118f130d93db3be4452ad8a0751509df

      SHA1

      4cac4b964784aadc7e6f41c21b854c668dca6981

      SHA256

      f7dec887c3345567ce86ce60cc8841a6a54eda35049811049debd1c5451656f4

      SHA512

      ec263d9cfc0a0324f8f79f6f6703f507d06f454cbc9964595a00d9606aae86c34920c8a10ef3d4413aceb85e33d731634200c0e7ee099b8a35baf8e69f46234f

      Download Submit

    • \Users\Admin\AppData\Local\Temp\7zS40BCF406\setup_install.exe
      Filesize

      125KB

      MD5

      166a0f5a1d4324a86b06e498f9aca017

      SHA1

      59cb941d9162e42bdb0a6c500ab1b96548c530ab

      SHA256

      01982aa36571313beda7d62fa41b41f3461196de2cfec4294a5b399f8a42140d

      SHA512

      cb068b60e23faf3e5d0279d0ce4016f8f23a21be460b0d7707417fa37d38b0a3d197934afae9191cdaa5a5c62186e66380ced82b38169e826d68a07fe610ff04

      Download Submit

    • \Users\Admin\AppData\Local\Temp\CC4F.tmp
      Filesize

      1.2MB

      MD5

      d124f55b9393c976963407dff51ffa79

      SHA1

      2c7bbedd79791bfb866898c85b504186db610b5d

      SHA256

      ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

      SHA512

      278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

      Download Submit

    • memory/1224-124-0x0000000002E20000-0x0000000002E35000-memory.dmp

      Filesize

      84KB

      Download

    • memory/1224-192-0x0000000002180000-0x0000000002195000-memory.dmp

      Filesize

      84KB

      Download

    • memory/1224-180-0x000007FEF5960000-0x000007FEF5AA3000-memory.dmp

      Filesize

      1.3MB

      Download

    • memory/1224-183-0x000007FF28600000-0x000007FF2860A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/1224-181-0x000007FF28600000-0x000007FF2860A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/1224-182-0x000007FEF5960000-0x000007FEF5AA3000-memory.dmp

      Filesize

      1.3MB

      Download

    • memory/2032-125-0x0000000000400000-0x0000000002B7B000-memory.dmp

      Filesize

      39.5MB

      Download

    • memory/2032-104-0x0000000002CA0000-0x0000000002DA0000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2032-119-0x0000000000400000-0x0000000002B7B000-memory.dmp

      Filesize

      39.5MB

      Download

    • memory/2032-105-0x0000000000250000-0x0000000000259000-memory.dmp

      Filesize

      36KB

      Download

    • memory/2760-190-0x0000000002FC0000-0x00000000030C0000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2760-191-0x0000000000400000-0x0000000002B7B000-memory.dmp

      Filesize

      39.5MB

      Download

    • memory/2760-195-0x0000000000400000-0x0000000002B7B000-memory.dmp

      Filesize

      39.5MB

      Download

    • memory/2820-26-0x0000000003000000-0x000000000311E000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2912-165-0x0000000000400000-0x0000000002B7B000-memory.dmp

      Filesize

      39.5MB

      Download

    • memory/2912-159-0x0000000002D50000-0x0000000002E50000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2932-60-0x0000000000400000-0x000000000051E000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2932-132-0x0000000064940000-0x0000000064959000-memory.dmp

      Filesize

      100KB

      Download

    • memory/2932-34-0x000000006B280000-0x000000006B2A6000-memory.dmp

      Filesize

      152KB

      Download

    • memory/2932-28-0x0000000000400000-0x000000000051E000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2932-63-0x0000000000400000-0x000000000051E000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2932-64-0x0000000000400000-0x000000000051E000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2932-61-0x0000000000400000-0x000000000051E000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2932-62-0x0000000000400000-0x000000000051E000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2932-59-0x0000000000400000-0x000000000051E000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2932-47-0x000000006B440000-0x000000006B4CF000-memory.dmp

      Filesize

      572KB

      Download

    • memory/2932-56-0x000000006B280000-0x000000006B2A6000-memory.dmp

      Filesize

      152KB

      Download

    • memory/2932-128-0x0000000000400000-0x000000000051E000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2932-130-0x000000006B440000-0x000000006B4CF000-memory.dmp

      Filesize

      572KB

      Download

    • memory/2932-129-0x000000006B280000-0x000000006B2A6000-memory.dmp

      Filesize

      152KB

      Download

    • memory/2932-133-0x000000006FE40000-0x000000006FFC6000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/2932-39-0x000000006B440000-0x000000006B4CF000-memory.dmp

      Filesize

      572KB

      Download

    • memory/2932-131-0x000000006EB40000-0x000000006EB63000-memory.dmp

      Filesize

      140KB

      Download

    • memory/2932-57-0x000000006B280000-0x000000006B2A6000-memory.dmp

      Filesize

      152KB

      Download

    • memory/2932-54-0x000000006FE40000-0x000000006FFC6000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/2932-175-0x000000006B280000-0x000000006B2A6000-memory.dmp

      Filesize

      152KB

      Download

    • memory/2932-176-0x000000006B440000-0x000000006B4CF000-memory.dmp

      Filesize

      572KB

      Download

    • memory/2932-177-0x000000006EB40000-0x000000006EB63000-memory.dmp

      Filesize

      140KB

      Download

    • memory/2932-178-0x0000000064940000-0x0000000064959000-memory.dmp

      Filesize

      100KB

      Download

    • memory/2932-179-0x000000006FE40000-0x000000006FFC6000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/2932-53-0x000000006FE40000-0x000000006FFC6000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/2932-52-0x000000006FE40000-0x000000006FFC6000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/2932-51-0x000000006FE40000-0x000000006FFC6000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/2932-50-0x000000006FE40000-0x000000006FFC6000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/2932-48-0x0000000064940000-0x0000000064959000-memory.dmp

      Filesize

      100KB

      Download

    • memory/2932-49-0x000000006B440000-0x000000006B4CF000-memory.dmp

      Filesize

      572KB

      Download

    • memory/2932-45-0x000000006FE40000-0x000000006FFC6000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/2932-46-0x000000006B440000-0x000000006B4CF000-memory.dmp

      Filesize

      572KB

      Download