Analysis
- max time kernel
139s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
10/04/2024, 14:46
General
- Target ec602e5151e622f2f47d79575dc42aacf84681c7f4f901b146a5edb85507f788.exe
- Size 4.3MB
- Sample240410-r5raqabf84
- SHA256 ec602e5151e622f2f47d79575dc42aacf84681c7f4f901b146a5edb85507f788
Malware Config
Extracted
-
nullmixer
-
http://estrix.xyz/
Signatures
- NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
- ASPack v2.12-2.42 4 IoCs
Detects executables packed with ASPack v2.12-2.42
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec602e5151e622f2f47d79575dc42aacf84681c7f4f901b146a5edb85507f788.exe"C:\Users\Admin\AppData\Local\Temp\ec602e5151e622f2f47d79575dc42aacf84681c7f4f901b146a5edb85507f788.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4A21EC78\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS4A21EC78\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 4724⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1096 -ip 10961⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3820 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
libcurl.dll
libcurlpp.dll
libgcc_s_dw2-1.dll
libstdc++-6.dll
libwinpthread-1.dll
setup_install.exe
setup_installer.exe
memory/1096-76-0x0000000000400000-0x000000000051D000-memory.dmp
memory/1096-70-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/1096-61-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1096-65-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1096-66-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1096-68-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1096-72-0x0000000000400000-0x000000000051D000-memory.dmp
memory/1096-74-0x0000000000400000-0x000000000051D000-memory.dmp
memory/1096-77-0x0000000000400000-0x000000000051D000-memory.dmp
memory/1096-59-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1096-75-0x0000000000400000-0x000000000051D000-memory.dmp
memory/1096-73-0x0000000000400000-0x000000000051D000-memory.dmp
memory/1096-71-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/1096-62-0x0000000064940000-0x0000000064959000-memory.dmp
memory/1096-69-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1096-67-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1096-64-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1096-63-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1096-58-0x0000000000EB0000-0x0000000000F3F000-memory.dmp
memory/1096-55-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/1096-45-0x0000000000400000-0x000000000051D000-memory.dmp
memory/1096-78-0x0000000000400000-0x000000000051D000-memory.dmp
memory/1096-83-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1096-82-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1096-81-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/1096-80-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/1096-79-0x0000000064940000-0x0000000064959000-memory.dmp