Resubmissions
04/03/2024, 11:53
240304-n2lpaahf5w1004/03/2024, 11:53
240304-n2crdaaf861004/03/2024, 03:09
240304-dnkvqagd5t10Analysis
- max time kernel
5s - max time network
11s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
04/03/2024, 11:53
General
- Target setup_installer.exe
- Size 3.3MB
- Sample240304-n2crdaaf86
- SHA256 6bc9c4e5a88eaa95550d066ff02f0d45b6bd2a93fbcb72b562c6c65ce06bb900
Malware Config
Extracted
-
nullmixer
-
http://watira.xyz/
Signatures
- NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
- PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
- RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
- ASPack v2.12-2.42 3 IoCs
Detects executables packed with ASPack v2.12-2.42
- VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4C320A77\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS4C320A77\setup_install.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 6eee9f336da6fcf1.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4C320A77\6eee9f336da6fcf1.exe6eee9f336da6fcf1.exe4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c98f61652.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4C320A77\c98f61652.exec98f61652.exe4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 01a389215e4.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4C320A77\01a389215e4.exe01a389215e4.exe4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c APPNAME33.exe3⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 9e27a03aab64665.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4C320A77\9e27a03aab64665.exe9e27a03aab64665.exe4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 1a693a205739887.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4C320A77\1a693a205739887.exe1a693a205739887.exe4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c efd22e6e99d7ee86.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4C320A77\efd22e6e99d7ee86.exeefd22e6e99d7ee86.exe4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 626c1e3ded0b288.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4C320A77\626c1e3ded0b288.exe626c1e3ded0b288.exe4⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 5523⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2264 -ip 22641⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
01a389215e4.exe
01a389215e4.exe
1a693a205739887.exe
626c1e3ded0b288.exe
6eee9f336da6fcf1.exe
9e27a03aab64665.exe
c98f61652.exe
efd22e6e99d7ee86.exe
efd22e6e99d7ee86.exe
libcurl.dll
libcurlpp.dll
libgcc_s_dw2-1.dll
libstdc++-6.dll
libwinpthread-1.dll
setup_install.exe
setup_install.exe
memory/1352-83-0x00007FFADE3F0000-0x00007FFADEEB1000-memory.dmp
memory/1352-68-0x0000000000610000-0x0000000000618000-memory.dmp
memory/2264-34-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2264-39-0x0000000064940000-0x0000000064959000-memory.dmp
memory/2264-42-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2264-38-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2264-36-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2264-41-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2264-40-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2264-43-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2264-37-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2264-30-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2264-35-0x00000000010C0000-0x000000000114F000-memory.dmp
memory/2264-32-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2264-31-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2548-82-0x0000000000240000-0x0000000000272000-memory.dmp
memory/3216-84-0x0000000002D70000-0x0000000002E70000-memory.dmp
memory/3216-85-0x00000000048E0000-0x000000000497D000-memory.dmp