Overview
overview
8Static
static
3MechvibesP....0.exe
windows7-x64
7MechvibesP....0.exe
windows10-2004-x64
8$PLUGINSDIR/INetC.dll
windows7-x64
3$PLUGINSDIR/INetC.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3$PLUGINSDIR/app-64.7z
windows7-x64
3$PLUGINSDIR/app-64.7z
windows10-2004-x64
3natives_blob.js
windows7-x64
3natives_blob.js
windows10-2004-x64
3resources/...ild.js
windows7-x64
3resources/...ild.js
windows10-2004-x64
3resources/...k.node
ubuntu-22.04-amd64
1resources/...ok.dll
windows7-x64
1resources/...ok.dll
windows10-2004-x64
1resources/...ok.dll
windows7-x64
1resources/...ok.dll
windows10-2004-x64
1resources/...k.node
ubuntu-18.04-amd64
1resources/...ok.dll
windows7-x64
1resources/...ok.dll
windows10-2004-x64
1resources/...ok.dll
windows7-x64
1resources/...ok.dll
windows10-2004-x64
1resources/...ocs.sh
ubuntu-18.04-amd64
4resources/...ocs.sh
debian-9-armhf
4resources/...ocs.sh
debian-9-mips
1resources/...ocs.sh
debian-9-mipsel
1Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
17-07-2024 20:09
Static task
static1
Behavioral task
behavioral1
Sample
MechvibesPlusPlus.Setup.2.4.0.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
MechvibesPlusPlus.Setup.2.4.0.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/INetC.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/INetC.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/app-64.7z
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/app-64.7z
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
natives_blob.js
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
natives_blob.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
resources/app.asar.unpacked/node_modules/iohook/build.js
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
resources/app.asar.unpacked/node_modules/iohook/build.js
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
resources/app.asar.unpacked/node_modules/iohook/builds/electron-v73-linux-x64/build/Release/iohook.node
Resource
ubuntu2204-amd64-20240611-en
Behavioral task
behavioral20
Sample
resources/app.asar.unpacked/node_modules/iohook/builds/electron-v73-win32-x64/build/Release/iohook.dll
Resource
win7-20240704-en
Behavioral task
behavioral21
Sample
resources/app.asar.unpacked/node_modules/iohook/builds/electron-v73-win32-x64/build/Release/iohook.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral22
Sample
resources/app.asar.unpacked/node_modules/iohook/builds/electron-v73-win32-x64/build/Release/uiohook.dll
Resource
win7-20240704-en
Behavioral task
behavioral23
Sample
resources/app.asar.unpacked/node_modules/iohook/builds/electron-v73-win32-x64/build/Release/uiohook.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral24
Sample
resources/app.asar.unpacked/node_modules/iohook/builds/node-v64-linux-x64/build/Release/iohook.node
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral25
Sample
resources/app.asar.unpacked/node_modules/iohook/builds/node-v64-win32-x64/build/Release/iohook.dll
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
resources/app.asar.unpacked/node_modules/iohook/builds/node-v64-win32-x64/build/Release/iohook.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
resources/app.asar.unpacked/node_modules/iohook/builds/node-v64-win32-x64/build/Release/uiohook.dll
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
resources/app.asar.unpacked/node_modules/iohook/builds/node-v64-win32-x64/build/Release/uiohook.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
resources/app.asar.unpacked/node_modules/iohook/deploy-docs.sh
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral30
Sample
resources/app.asar.unpacked/node_modules/iohook/deploy-docs.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral31
Sample
resources/app.asar.unpacked/node_modules/iohook/deploy-docs.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral32
Sample
resources/app.asar.unpacked/node_modules/iohook/deploy-docs.sh
Resource
debian9-mipsel-20240418-en
General
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
75ed96254fbf894e42058062b4b4f0d1
-
SHA1
996503f1383b49021eb3427bc28d13b5bbd11977
-
SHA256
a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
-
SHA512
58174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
-
SSDEEP
192:X24sihno0bW+l97H4GB7QDs91kMtwtobTr4u+QHbazMNHT7dmNIEr:m8vJl97JeoxtN/r3z7YV
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3580 1748 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 1936 wrote to memory of 1748 1936 rundll32.exe rundll32.exe PID 1936 wrote to memory of 1748 1936 rundll32.exe rundll32.exe PID 1936 wrote to memory of 1748 1936 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#12⤵PID:1748
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 6123⤵
- Program crash
PID:3580
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1748 -ip 17481⤵PID:1404