Overview
overview
8Static
static
3MechvibesP....0.exe
windows7-x64
7MechvibesP....0.exe
windows10-2004-x64
8$PLUGINSDIR/INetC.dll
windows7-x64
3$PLUGINSDIR/INetC.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3$PLUGINSDIR/app-64.7z
windows7-x64
3$PLUGINSDIR/app-64.7z
windows10-2004-x64
3natives_blob.js
windows7-x64
3natives_blob.js
windows10-2004-x64
3resources/...ild.js
windows7-x64
3resources/...ild.js
windows10-2004-x64
3resources/...k.node
ubuntu-22.04-amd64
1resources/...ok.dll
windows7-x64
1resources/...ok.dll
windows10-2004-x64
1resources/...ok.dll
windows7-x64
1resources/...ok.dll
windows10-2004-x64
1resources/...k.node
ubuntu-18.04-amd64
1resources/...ok.dll
windows7-x64
1resources/...ok.dll
windows10-2004-x64
1resources/...ok.dll
windows7-x64
1resources/...ok.dll
windows10-2004-x64
1resources/...ocs.sh
ubuntu-18.04-amd64
4resources/...ocs.sh
debian-9-armhf
4resources/...ocs.sh
debian-9-mips
1resources/...ocs.sh
debian-9-mipsel
1Analysis
-
max time kernel
119s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
17-07-2024 20:09
Static task
static1
Behavioral task
behavioral1
Sample
MechvibesPlusPlus.Setup.2.4.0.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
MechvibesPlusPlus.Setup.2.4.0.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/INetC.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/INetC.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/app-64.7z
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/app-64.7z
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
natives_blob.js
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
natives_blob.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
resources/app.asar.unpacked/node_modules/iohook/build.js
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
resources/app.asar.unpacked/node_modules/iohook/build.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
resources/app.asar.unpacked/node_modules/iohook/builds/electron-v73-linux-x64/build/Release/iohook.node
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral20
Sample
resources/app.asar.unpacked/node_modules/iohook/builds/electron-v73-win32-x64/build/Release/iohook.dll
Resource
win7-20240704-en
Behavioral task
behavioral21
Sample
resources/app.asar.unpacked/node_modules/iohook/builds/electron-v73-win32-x64/build/Release/iohook.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral22
Sample
resources/app.asar.unpacked/node_modules/iohook/builds/electron-v73-win32-x64/build/Release/uiohook.dll
Resource
win7-20240704-en
Behavioral task
behavioral23
Sample
resources/app.asar.unpacked/node_modules/iohook/builds/electron-v73-win32-x64/build/Release/uiohook.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral24
Sample
resources/app.asar.unpacked/node_modules/iohook/builds/node-v64-linux-x64/build/Release/iohook.node
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral25
Sample
resources/app.asar.unpacked/node_modules/iohook/builds/node-v64-win32-x64/build/Release/iohook.dll
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
resources/app.asar.unpacked/node_modules/iohook/builds/node-v64-win32-x64/build/Release/iohook.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
resources/app.asar.unpacked/node_modules/iohook/builds/node-v64-win32-x64/build/Release/uiohook.dll
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
resources/app.asar.unpacked/node_modules/iohook/builds/node-v64-win32-x64/build/Release/uiohook.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
resources/app.asar.unpacked/node_modules/iohook/deploy-docs.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral30
Sample
resources/app.asar.unpacked/node_modules/iohook/deploy-docs.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral31
Sample
resources/app.asar.unpacked/node_modules/iohook/deploy-docs.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral32
Sample
resources/app.asar.unpacked/node_modules/iohook/deploy-docs.sh
Resource
debian9-mipsel-20240418-en
General
-
Target
$PLUGINSDIR/app-64.7z
-
Size
60.3MB
-
MD5
86fbfdba59094a3d09b47f6aa0f41494
-
SHA1
364f2df61b70d8eb50b1c0e58c55ce50106dc1b7
-
SHA256
a7057f26e5d5f58578370940050c4623fb91dbba2e5a3e5408fcc0d7087f923f
-
SHA512
64aa71dd9a34bd43c8bdc643e800f15ad746068cef68a7bdecf396bf1d0ecb4d53db77dd4f4ff4c19a68b56fe199c7520c22d9bd4891a9af960998536f13a885
-
SSDEEP
1572864:+b4n3FnJiUkcWP/zKmSJIrlMGDDORT0OBqbSzltm+LA3c:B3FHT5mSJ8DDgTdCSR4c
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
rundll32.exerundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2192 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2192 AcroRd32.exe 2192 AcroRd32.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
cmd.exerundll32.exerundll32.exedescription pid process target process PID 2636 wrote to memory of 2564 2636 cmd.exe rundll32.exe PID 2636 wrote to memory of 2564 2636 cmd.exe rundll32.exe PID 2636 wrote to memory of 2564 2636 cmd.exe rundll32.exe PID 2564 wrote to memory of 2640 2564 rundll32.exe rundll32.exe PID 2564 wrote to memory of 2640 2564 rundll32.exe rundll32.exe PID 2564 wrote to memory of 2640 2564 rundll32.exe rundll32.exe PID 2640 wrote to memory of 2192 2640 rundll32.exe AcroRd32.exe PID 2640 wrote to memory of 2192 2640 rundll32.exe AcroRd32.exe PID 2640 wrote to memory of 2192 2640 rundll32.exe AcroRd32.exe PID 2640 wrote to memory of 2192 2640 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z1⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\app-64.7z"4⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2192
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD531b19fc1bd16aeb5257893e7928d8d32
SHA108f400e950c0665725f77095d9dd57a221e270d6
SHA256fa2a9f5945f8d3dea3e0bfebb911670add4f7a1ec03c20b1bb6b7043e307a4ea
SHA5123f62aa28bb7ef671d90ce8fc0dc170bb71f07d557b16e6b5fe62676a864b7f5d2e031989f24dbcf2848c1b8bd67c7c113e921d87c39e60b01711c695399c23ff