Overview
overview
8Static
static
3MechvibesP....0.exe
windows7-x64
7MechvibesP....0.exe
windows10-2004-x64
8$PLUGINSDIR/INetC.dll
windows7-x64
3$PLUGINSDIR/INetC.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3$PLUGINSDIR/app-64.7z
windows7-x64
3$PLUGINSDIR/app-64.7z
windows10-2004-x64
3natives_blob.js
windows7-x64
3natives_blob.js
windows10-2004-x64
3resources/...ild.js
windows7-x64
3resources/...ild.js
windows10-2004-x64
3resources/...k.node
ubuntu-22.04-amd64
1resources/...ok.dll
windows7-x64
1resources/...ok.dll
windows10-2004-x64
1resources/...ok.dll
windows7-x64
1resources/...ok.dll
windows10-2004-x64
1resources/...k.node
ubuntu-18.04-amd64
1resources/...ok.dll
windows7-x64
1resources/...ok.dll
windows10-2004-x64
1resources/...ok.dll
windows7-x64
1resources/...ok.dll
windows10-2004-x64
1resources/...ocs.sh
ubuntu-18.04-amd64
4resources/...ocs.sh
debian-9-armhf
4resources/...ocs.sh
debian-9-mips
1resources/...ocs.sh
debian-9-mipsel
1Analysis
-
max time kernel
146s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
17-07-2024 20:09
Static task
static1
Behavioral task
behavioral1
Sample
MechvibesPlusPlus.Setup.2.4.0.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
MechvibesPlusPlus.Setup.2.4.0.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/INetC.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/INetC.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/app-64.7z
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/app-64.7z
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
natives_blob.js
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
natives_blob.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
resources/app.asar.unpacked/node_modules/iohook/build.js
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
resources/app.asar.unpacked/node_modules/iohook/build.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
resources/app.asar.unpacked/node_modules/iohook/builds/electron-v73-linux-x64/build/Release/iohook.node
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral20
Sample
resources/app.asar.unpacked/node_modules/iohook/builds/electron-v73-win32-x64/build/Release/iohook.dll
Resource
win7-20240704-en
Behavioral task
behavioral21
Sample
resources/app.asar.unpacked/node_modules/iohook/builds/electron-v73-win32-x64/build/Release/iohook.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral22
Sample
resources/app.asar.unpacked/node_modules/iohook/builds/electron-v73-win32-x64/build/Release/uiohook.dll
Resource
win7-20240704-en
Behavioral task
behavioral23
Sample
resources/app.asar.unpacked/node_modules/iohook/builds/electron-v73-win32-x64/build/Release/uiohook.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral24
Sample
resources/app.asar.unpacked/node_modules/iohook/builds/node-v64-linux-x64/build/Release/iohook.node
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral25
Sample
resources/app.asar.unpacked/node_modules/iohook/builds/node-v64-win32-x64/build/Release/iohook.dll
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
resources/app.asar.unpacked/node_modules/iohook/builds/node-v64-win32-x64/build/Release/iohook.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
resources/app.asar.unpacked/node_modules/iohook/builds/node-v64-win32-x64/build/Release/uiohook.dll
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
resources/app.asar.unpacked/node_modules/iohook/builds/node-v64-win32-x64/build/Release/uiohook.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
resources/app.asar.unpacked/node_modules/iohook/deploy-docs.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral30
Sample
resources/app.asar.unpacked/node_modules/iohook/deploy-docs.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral31
Sample
resources/app.asar.unpacked/node_modules/iohook/deploy-docs.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral32
Sample
resources/app.asar.unpacked/node_modules/iohook/deploy-docs.sh
Resource
debian9-mipsel-20240418-en
General
-
Target
$PLUGINSDIR/app-64.7z
-
Size
60.3MB
-
MD5
86fbfdba59094a3d09b47f6aa0f41494
-
SHA1
364f2df61b70d8eb50b1c0e58c55ce50106dc1b7
-
SHA256
a7057f26e5d5f58578370940050c4623fb91dbba2e5a3e5408fcc0d7087f923f
-
SHA512
64aa71dd9a34bd43c8bdc643e800f15ad746068cef68a7bdecf396bf1d0ecb4d53db77dd4f4ff4c19a68b56fe199c7520c22d9bd4891a9af960998536f13a885
-
SSDEEP
1572864:+b4n3FnJiUkcWP/zKmSJIrlMGDDORT0OBqbSzltm+LA3c:B3FHT5mSJ8DDgTdCSR4c
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 3640 OpenWith.exe