Analysis
- max time kernel
57s - max time network
86s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
15/03/2024, 05:42
General
- Target ca9f451b687026440ae4c635ef47d5a0.exe
- Size 4.0MB
- Sample240315-gd9ymsbd69
- SHA256 59babf45239a61449061a606bd3f578c3caf0d604c1b9db4504e74582c6a4d30
Malware Config
Extracted
-
privateloader
-
http://37.0.10.214/proxies.txt
-
http://37.0.10.171/server.txt
-
http://wfsdragon.ru/api/setStats.php
-
37.0.10.185
Extracted
-
redline
-
pab3
-
185.215.113.15:61506
Extracted
-
nullmixer
-
http://watira.xyz/
Extracted
-
vidar
-
40
-
706
-
https://lenak513.tumblr.com/
-
profile_id
706
Extracted
-
smokeloader
-
pub5
Extracted
-
smokeloader
-
2020
-
http://aucmoney.com/upload/
-
http://thegymmum.com/upload/
-
http://atvcampingtrips.com/upload/
-
http://kuapakualaman.com/upload/
-
http://renatazarazua.com/upload/
-
http://nasufmutlu.com/upload/
Signatures
- NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
- PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 2 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Vidar Stealer 2 IoCs
- ASPack v2.12-2.42 3 IoCs
Detects executables packed with ASPack v2.12-2.42
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 12 IoCs
- Loads dropped DLL 6 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 7 IoCs
- Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Modifies data under HKEY_USERS 18 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 34 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 16 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca9f451b687026440ae4c635ef47d5a0.exe"C:\Users\Admin\AppData\Local\Temp\ca9f451b687026440ae4c635ef47d5a0.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8EF714A7\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS8EF714A7\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1967673abd.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8EF714A7\Tue1967673abd.exeTue1967673abd.exe4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS8EF714A7\Tue1967673abd.exe"C:\Users\Admin\AppData\Local\Temp\7zS8EF714A7\Tue1967673abd.exe" -a5⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19fc1515e912.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8EF714A7\Tue19fc1515e912.exeTue19fc1515e912.exe4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19f37e110827fe3a3.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8EF714A7\Tue19f37e110827fe3a3.exeTue19f37e110827fe3a3.exe4⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1989b76beff0f4.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8EF714A7\Tue1989b76beff0f4.exeTue1989b76beff0f4.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 8245⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 8445⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 8725⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 8845⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 9925⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2704 -s 10605⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19e90e5a24d668e.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8EF714A7\Tue19e90e5a24d668e.exeTue19e90e5a24d668e.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue195a21241231e.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8EF714A7\Tue195a21241231e.exeTue195a21241231e.exe4⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19c0a1cc11b.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8EF714A7\Tue19c0a1cc11b.exeTue19c0a1cc11b.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1930b79f0e40342.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8EF714A7\Tue1930b79f0e40342.exeTue1930b79f0e40342.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllhost.exedllhost.exe5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Vai.pdf5⤵
-
C:\Windows\SysWOW64\cmd.execmd6⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^mtHoKMPFYDHibgXoaLvAaWsXCpDWIDAtGvzDsjSTgLhRLduwJPppYNJDMJFBoSWxeCBqVxQuTCkHIAkke$" Dal.pdf7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Volevo.exe.comVolevo.exe.com H7⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\PING.EXEping ETDALPOV -n 307⤵
- Runs ping.exe
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue195ffe36751a0340.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8EF714A7\Tue195ffe36751a0340.exeTue195ffe36751a0340.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 5643⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2024 -ip 20241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2704 -ip 27041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2704 -ip 27041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2704 -ip 27041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2704 -ip 27041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2704 -ip 27041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2704 -ip 27041⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Tue1930b79f0e40342.exe
Tue195a21241231e.exe
Tue195ffe36751a0340.exe
Tue1967673abd.exe
Tue1989b76beff0f4.exe
Tue19c0a1cc11b.exe
Tue19e90e5a24d668e.exe
Tue19f37e110827fe3a3.exe
Tue19fc1515e912.exe
libcurl.dll
libcurlpp.dll
libgcc_s_dw2-1.dll
libstdc++-6.dll
libwinpthread-1.dll
setup_install.exe
Dal.pdf
Dir.pdf
Vai.pdf
Volevo.exe.com
__PSScriptPolicyTest_bossptvf.1dv.ps1
memory/416-120-0x0000000007F50000-0x0000000007F9C000-memory.dmp
memory/416-103-0x0000000002F60000-0x0000000003060000-memory.dmp
memory/416-111-0x0000000007ED0000-0x0000000007EE2000-memory.dmp
memory/416-194-0x0000000002F60000-0x0000000003060000-memory.dmp
memory/416-192-0x0000000007290000-0x00000000072A0000-memory.dmp
memory/416-191-0x0000000007290000-0x00000000072A0000-memory.dmp
memory/416-190-0x0000000007290000-0x00000000072A0000-memory.dmp
memory/416-107-0x0000000004CA0000-0x0000000004CC0000-memory.dmp
memory/416-189-0x0000000072F70000-0x0000000073720000-memory.dmp
memory/416-105-0x00000000072A0000-0x0000000007844000-memory.dmp
memory/416-149-0x0000000007290000-0x00000000072A0000-memory.dmp
memory/416-142-0x0000000007290000-0x00000000072A0000-memory.dmp
memory/416-97-0x0000000004C70000-0x0000000004C92000-memory.dmp
memory/416-141-0x0000000007290000-0x00000000072A0000-memory.dmp
memory/416-140-0x0000000007290000-0x00000000072A0000-memory.dmp
memory/416-138-0x0000000072F70000-0x0000000073720000-memory.dmp
memory/416-112-0x0000000007EF0000-0x0000000007F2C000-memory.dmp
memory/416-131-0x00000000080E0000-0x00000000081EA000-memory.dmp
memory/416-121-0x0000000000400000-0x0000000002CD3000-memory.dmp
memory/416-110-0x0000000007850000-0x0000000007E68000-memory.dmp
memory/416-104-0x0000000004800000-0x000000000482F000-memory.dmp
memory/528-99-0x000000001B3A0000-0x000000001B3B0000-memory.dmp
memory/528-86-0x00007FF882930000-0x00007FF8833F1000-memory.dmp
memory/528-81-0x0000000000680000-0x0000000000688000-memory.dmp
memory/528-193-0x000000001B3A0000-0x000000001B3B0000-memory.dmp
memory/2024-134-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2024-52-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2024-60-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2024-57-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2024-58-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2024-59-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2024-53-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2024-56-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2024-50-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2024-55-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2024-128-0x0000000000400000-0x000000000051B000-memory.dmp
memory/2024-130-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2024-51-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2024-133-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/2024-61-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2024-132-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2024-129-0x0000000064940000-0x0000000064959000-memory.dmp
memory/2024-54-0x0000000064940000-0x0000000064959000-memory.dmp
memory/2288-146-0x0000000000400000-0x00000000023AC000-memory.dmp
memory/2288-143-0x0000000002640000-0x0000000002740000-memory.dmp
memory/2288-145-0x00000000001C0000-0x00000000001C9000-memory.dmp
memory/2704-136-0x0000000000400000-0x0000000002D1A000-memory.dmp
memory/2704-127-0x00000000049A0000-0x0000000004A3D000-memory.dmp
memory/2704-148-0x0000000002F50000-0x0000000003050000-memory.dmp
memory/3272-152-0x0000000002710000-0x0000000002726000-memory.dmp
memory/3920-106-0x00000000020A0000-0x00000000020A6000-memory.dmp
memory/3920-98-0x00007FF882930000-0x00007FF8833F1000-memory.dmp
memory/3920-102-0x0000000002080000-0x00000000020A2000-memory.dmp
memory/3920-139-0x00007FF882930000-0x00007FF8833F1000-memory.dmp
memory/3920-83-0x00000000000F0000-0x000000000011C000-memory.dmp
memory/3920-96-0x0000000002070000-0x0000000002076000-memory.dmp
memory/4788-176-0x0000000006210000-0x000000000622E000-memory.dmp
memory/4788-180-0x0000000007250000-0x00000000072E6000-memory.dmp
memory/4788-85-0x00000000026A0000-0x00000000026D6000-memory.dmp
memory/4788-109-0x0000000004BB0000-0x0000000004BD2000-memory.dmp
memory/4788-163-0x0000000004880000-0x0000000004890000-memory.dmp
memory/4788-165-0x0000000006230000-0x0000000006262000-memory.dmp
memory/4788-100-0x0000000004880000-0x0000000004890000-memory.dmp
memory/4788-166-0x000000006F360000-0x000000006F3AC000-memory.dmp
memory/4788-177-0x0000000006C50000-0x0000000006CF3000-memory.dmp
memory/4788-178-0x0000000006FD0000-0x0000000006FEA000-memory.dmp
memory/4788-179-0x0000000007060000-0x000000000706A000-memory.dmp
memory/4788-147-0x0000000072F70000-0x0000000073720000-memory.dmp
memory/4788-181-0x00000000071C0000-0x00000000071D1000-memory.dmp
memory/4788-182-0x00000000071F0000-0x00000000071FE000-memory.dmp
memory/4788-183-0x0000000007200000-0x0000000007214000-memory.dmp
memory/4788-184-0x0000000007310000-0x000000000732A000-memory.dmp
memory/4788-185-0x00000000072F0000-0x00000000072F8000-memory.dmp
memory/4788-188-0x0000000072F70000-0x0000000073720000-memory.dmp
memory/4788-144-0x0000000005CA0000-0x0000000005CBE000-memory.dmp
memory/4788-126-0x0000000005660000-0x00000000059B4000-memory.dmp
memory/4788-95-0x0000000004EC0000-0x00000000054E8000-memory.dmp
memory/4788-114-0x00000000055F0000-0x0000000005656000-memory.dmp
memory/4788-113-0x0000000004E50000-0x0000000004EB6000-memory.dmp
memory/4788-101-0x0000000004880000-0x0000000004890000-memory.dmp