Analysis
- max time kernel
300s - max time network
301s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
10/04/2024, 04:40
General
- Target setup_installer.exe
- Size 3.9MB
- Sample240410-fa2mesgd4v
- SHA256 b89fdf606986324fa9260f434dc1561d716985d0886fba180b88f3afb9dec729
Malware Config
Extracted
-
nullmixer
-
http://marisana.xyz/
Extracted
-
privateloader
-
http://37.0.10.214/proxies.txt
-
http://37.0.10.171/server.txt
-
http://wfsdragon.ru/api/setStats.php
-
37.0.10.185
Extracted
-
smokeloader
-
pub6
Extracted
-
vidar
-
40
-
706
-
https://lenak513.tumblr.com/
-
profile_id
706
Extracted
-
redline
-
pab3
-
185.215.113.15:61506
Extracted
-
smokeloader
-
2020
-
http://aucmoney.com/upload/
-
http://thegymmum.com/upload/
-
http://atvcampingtrips.com/upload/
-
http://kuapakualaman.com/upload/
-
http://renatazarazua.com/upload/
-
http://nasufmutlu.com/upload/
Extracted
-
cryptbot
-
knurxh28.top
-
moraku02.top
-
payload_url
http://sargym03.top/download.php?file=lv.exe
Signatures
- CryptBot
A C++ stealer distributed widely in bundle with other software.
- CryptBot payload 6 IoCs
- NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
- PrivateLoader 1 IoCs
PrivateLoader.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
- SectopRAT payload 2 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Vidar Stealer 3 IoCs
- ASPack v2.12-2.42 3 IoCs
Detects executables packed with ASPack v2.12-2.42
- Executes dropped EXE 13 IoCs
- Loads dropped DLL 52 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies system certificate store 2 TTPs 12 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of FindShellTrayWindow 8 IoCs
- Suspicious use of SendNotifyMessage 6 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS06BFFA26\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS06BFFA26\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19301d0ee47f9.exe3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS06BFFA26\Tue19301d0ee47f9.exeTue19301d0ee47f9.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS06BFFA26\Tue19301d0ee47f9.exe"C:\Users\Admin\AppData\Local\Temp\7zS06BFFA26\Tue19301d0ee47f9.exe" -a5⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1931cb6307cc71e4.exe3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS06BFFA26\Tue1931cb6307cc71e4.exeTue1931cb6307cc71e4.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1928d87039b3a61.exe3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS06BFFA26\Tue1928d87039b3a61.exeTue1928d87039b3a61.exe4⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19638bb08519f.exe3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS06BFFA26\Tue19638bb08519f.exeTue19638bb08519f.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 9565⤵
- Loads dropped DLL
- Program crash
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue1911a97ae09.exe3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS06BFFA26\Tue1911a97ae09.exeTue1911a97ae09.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue195f40779b28e9814.exe3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS06BFFA26\Tue195f40779b28e9814.exeTue195f40779b28e9814.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19519844d595cb.exe3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS06BFFA26\Tue19519844d595cb.exeTue19519844d595cb.exe4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue190a6b23f5160050.exe3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS06BFFA26\Tue190a6b23f5160050.exeTue190a6b23f5160050.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
C:\Windows\SysWOW64\dllhost.exedllhost.exe5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Vai.pdf5⤵
-
C:\Windows\SysWOW64\cmd.execmd6⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^mtHoKMPFYDHibgXoaLvAaWsXCpDWIDAtGvzDsjSTgLhRLduwJPppYNJDMJFBoSWxeCBqVxQuTCkHIAkke$" Dal.pdf7⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Volevo.exe.comVolevo.exe.com H7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Volevo.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Volevo.exe.com H8⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Windows\SysWOW64\PING.EXEping QGTQZTRE -n 307⤵
- Runs ping.exe
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue19167b39532817c6.exe3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS06BFFA26\Tue19167b39532817c6.exeTue19167b39532817c6.exe4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 4323⤵
- Loads dropped DLL
- Program crash
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
94308059B57B3142E455B38A6EB92015
94308059B57B3142E455B38A6EB92015
_Information.txt
_Information.txt
_Screen_Desktop.jpeg
system_info.txt
system_info.txt
ptAf023WzUIqC.zip
sWZfaX2YdU43.zip
Tue190a6b23f5160050.exe
Tue1911a97ae09.exe
Tue19167b39532817c6.exe
Tue1928d87039b3a61.exe
Tue19301d0ee47f9.exe
Tue1931cb6307cc71e4.exe
Tue19519844d595cb.exe
Tue195f40779b28e9814.exe
Tue19638bb08519f.exe
libstdc++-6.dll
Tar1BF1.tmp
libcurl.dll
libcurlpp.dll
libgcc_s_dw2-1.dll
libwinpthread-1.dll
setup_install.exe
memory/332-128-0x00000000003D0000-0x00000000003D9000-memory.dmp
memory/332-366-0x0000000000400000-0x00000000023AC000-memory.dmp
memory/332-131-0x0000000002440000-0x0000000002540000-memory.dmp
memory/332-129-0x0000000000400000-0x00000000023AC000-memory.dmp
memory/884-156-0x0000000002E30000-0x0000000002F30000-memory.dmp
memory/884-153-0x0000000000400000-0x0000000002D1A000-memory.dmp
memory/884-149-0x0000000002D20000-0x0000000002DBD000-memory.dmp
memory/884-375-0x0000000000400000-0x0000000002D1A000-memory.dmp
memory/884-398-0x0000000002E30000-0x0000000002F30000-memory.dmp
memory/1152-146-0x0000000000400000-0x0000000002CD3000-memory.dmp
memory/1152-152-0x0000000004B20000-0x0000000004B42000-memory.dmp
memory/1152-397-0x0000000000260000-0x0000000000360000-memory.dmp
memory/1152-158-0x0000000007630000-0x0000000007670000-memory.dmp
memory/1152-157-0x0000000004D40000-0x0000000004D60000-memory.dmp
memory/1152-154-0x0000000000260000-0x0000000000360000-memory.dmp
memory/1152-143-0x0000000002CE0000-0x0000000002D0F000-memory.dmp
memory/1176-365-0x0000000003A80000-0x0000000003A96000-memory.dmp
memory/1472-390-0x0000000003D40000-0x0000000003DE3000-memory.dmp
memory/1472-407-0x0000000003D40000-0x0000000003DE3000-memory.dmp
memory/1472-388-0x0000000003D40000-0x0000000003DE3000-memory.dmp
memory/1472-642-0x0000000003D40000-0x0000000003DE3000-memory.dmp
memory/1472-389-0x0000000003D40000-0x0000000003DE3000-memory.dmp
memory/1472-386-0x0000000003D40000-0x0000000003DE3000-memory.dmp
memory/1472-385-0x0000000003D40000-0x0000000003DE3000-memory.dmp
memory/1472-387-0x0000000003D40000-0x0000000003DE3000-memory.dmp
memory/1472-391-0x0000000003D40000-0x0000000003DE3000-memory.dmp
memory/2340-130-0x000000001B1A0000-0x000000001B220000-memory.dmp
memory/2340-378-0x000000001B1A0000-0x000000001B220000-memory.dmp
memory/2340-125-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp
memory/2340-121-0x0000000000330000-0x0000000000338000-memory.dmp
memory/2340-377-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp
memory/2556-159-0x00000000736C0000-0x0000000073C6B000-memory.dmp
memory/2556-155-0x00000000027C0000-0x0000000002800000-memory.dmp
memory/2556-142-0x00000000736C0000-0x0000000073C6B000-memory.dmp
memory/2660-68-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2660-69-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2660-373-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/2660-372-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2660-371-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2660-370-0x0000000064940000-0x0000000064959000-memory.dmp
memory/2660-369-0x0000000000400000-0x000000000051B000-memory.dmp
memory/2660-53-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2660-59-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2660-62-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2660-66-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2660-71-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2660-51-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2660-60-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2660-61-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/2660-63-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2660-64-0x0000000064940000-0x0000000064959000-memory.dmp
memory/2660-65-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2660-67-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2660-374-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/2660-70-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2660-72-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/2708-122-0x0000000000200000-0x0000000000220000-memory.dmp
memory/2708-127-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp
memory/2708-126-0x00000000001D0000-0x00000000001EA000-memory.dmp
memory/2708-132-0x000000001A760000-0x000000001A7E0000-memory.dmp
memory/2708-364-0x000007FEF5BC0000-0x000007FEF65AC000-memory.dmp