Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04-11-2024 17:00

General

  • Target

    setup_installer.exe

  • Size

    9.5MB

  • MD5

    e5debd90b07e67f9b1ae38e4412c86c4

  • SHA1

    4b7e7161161709a25e5e655ee60f6eae3fa39c32

  • SHA256

    c5c7eade46a64e20a9eae3757ec58a0c62f3d7e33971bacd7064a97588af39d8

  • SHA512

    fb3bf8a363bac644f5ded4bd30ab779aa54d3e118b73893466ca93b738ad42f93ce0f3aafb7d1a1e0863f4a1506ac5faf588c344f4e812611e9c734157fe3113

  • SSDEEP

    196608:xvlB860t1YFNDe2EuiwRBCpzp02nvIpO2XLrY1omCZHf8uXW8dDxQj:xvlBb0twDiuiLpnnMfHYebHUIHDO

Malware Config

Extracted

Family

nullmixer

C2

http://6246f7513680d.com/

Extracted

Family

socelars

C2

https://sa-us-bucket.s3.us-east-2.amazonaws.com/vsdh41/

Signatures

  • NullMixer

    NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.

  • Nullmixer family
  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars family
  • Socelars payload 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • ASPack v2.12-2.42 4 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 11 IoCs
  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2176
    • C:\Users\Admin\AppData\Local\Temp\7zS08841457\setup_install.exe
      "C:\Users\Admin\AppData\Local\Temp\7zS08841457\setup_install.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2920
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2540
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2928
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c 6246f7528c7e5_Fri13be9f3c6.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2488
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c 6246f75363f77_Fri1366dac3a944.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1260
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c 6246f75453fd2_Fri1347852ec.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1276
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c 6246f76c1f60f_Fri1395d364.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2340
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c 6246f76e6acbe_Fri134d8724752.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2124
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c 6246f7710e6e4_Fri133f08d0114d.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1848
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c 6246f7a522790_Fri130206254.exe /mixtwo
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2872
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c 6246f7a7a151d_Fri137e98926fc.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1808
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c 6246f7a94bb5c_Fri136aafed62.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2976
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c 6246f7aa4b416_Fri133529ec01f5.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2988
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c 6246f7ab338f8_Fri13f726be9ff.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2536
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c 6246f7ae19ce0_Fri13a868de1.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2672
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c 6246f7af345ac_Fri13b7f06884.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2932

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7zS08841457\6246f7528c7e5_Fri13be9f3c6.exe

    Filesize

    20KB

    MD5

    98c3385d313ae6d4cf1f192830f6b555

    SHA1

    31c572430094e9adbf5b7647c3621b2e8dfa7fe8

    SHA256

    4b2e2adafc390f535254a650a90e6a559fb3613a9f13ce648a024c078fcf40be

    SHA512

    fdd0406ef1abee43877c2ab2be9879e7232e773f7dac48f38a883b14306907c82110c712065a290bafac3cc8b0f4c0a13694847ad60a50a2b87e6aed2fd73aff

  • C:\Users\Admin\AppData\Local\Temp\7zS08841457\6246f75363f77_Fri1366dac3a944.exe

    Filesize

    152KB

    MD5

    e0f600d0f15da0780b95105788201417

    SHA1

    9cc5b5d64157444815b101f8500c8535b36a4e62

    SHA256

    938cbc262bfa2cdf449c75a47d92ef6a719f298ce96598057d42476b3098f5a4

    SHA512

    a95aa09cd549ea32a1ddd1c78c6a1b90a2720f962f095377a321cf61af0fd5e22fafd40bf13c9d1135c5a71a1b82201c47680e8eedae20c1321d60186bb097cb

  • C:\Users\Admin\AppData\Local\Temp\7zS08841457\6246f75453fd2_Fri1347852ec.exe

    Filesize

    312KB

    MD5

    479ba7ea1f2fa2cd51a3ca59a9638010

    SHA1

    8992de6c918131fbe8821dd16cc0277951cd362c

    SHA256

    d66c7fb807beccc1fa5a7d4162d3e8e2d553ba560653a404e1ce6de68ba8c801

    SHA512

    70be353017f77f5b4fd82738700843bdc5848f175a39d07626dd9f4cb59b4d685dadf69de156f00c62dcc76f8fba233656df258ea103e1000ff038305580179f

  • C:\Users\Admin\AppData\Local\Temp\7zS08841457\6246f76c1f60f_Fri1395d364.exe

    Filesize

    1.5MB

    MD5

    aa1a33a40570d4fd2f17c569f4ab1170

    SHA1

    fc9b9b6ef3235ea76c3b5fd5ded6b4554eaa01c2

    SHA256

    e97a44529a5f1e223d471f68a1fe6bddb0754b4a4880067b6872154a781fd6a5

    SHA512

    a1335b6b2c07ff9543634ffc3162facd8bac8d1bf24ed0a2a36246981994785838b5b1343c44bcf55ce771dfe5bcda44a18fc0bdd9cdee5f7f652065642bf115

  • C:\Users\Admin\AppData\Local\Temp\7zS08841457\6246f76e6acbe_Fri134d8724752.exe

    Filesize

    251KB

    MD5

    c4753d4efda428971afd33ec13a00e9b

    SHA1

    8801c82e95d5d5ab2c87e81b6b7768142df957f3

    SHA256

    8704c0b6842fd04928290c56a7cacb70e920c1af0ebad2bc981d5005345377b8

    SHA512

    b651210962348faa03ec31874e37958c9294e58aa709199ffaa7f4e53d39e4100e2c2457f65bb0e72e5b8293ff07be0c421f8073f0d2b67a8923b5292f5300b0

  • C:\Users\Admin\AppData\Local\Temp\7zS08841457\6246f7710e6e4_Fri133f08d0114d.exe

    Filesize

    2.1MB

    MD5

    d51275ff35e617742f06569fe0dc9cde

    SHA1

    ec6f2e1ff8463c1f8d3cc4421af5815798e053f6

    SHA256

    3d8077e64cf958be5a75783bba6c01719debd50a55b02d23d12e758ee7af5a8b

    SHA512

    e2f37ccf8bf221ac779f53d20029f7caa85cdef56ade371b82a8ac366420bc6abdcf47b2d1f7f83ed70420752822a60b7026cba7e2372d49438c5e9949b8a71a

  • C:\Users\Admin\AppData\Local\Temp\7zS08841457\6246f7a522790_Fri130206254.exe

    Filesize

    371KB

    MD5

    6eced1a017445828224259a62a663478

    SHA1

    e478e5e94d4fdb6d3f7c9bc1eb3a3faef7a27a8b

    SHA256

    9caee013dc3b0158f883dd8926181e10993612769504be3884f0c5eb49c0a524

    SHA512

    878892ba72658b67a78c1add2a5c0af900ed0d40a44664c89c993aa3a6b0733957d7f11317b8942e51c0139afea967f7ef3e9dc23ed0cc75f8553fd23d92fe64

  • C:\Users\Admin\AppData\Local\Temp\7zS08841457\6246f7a7a151d_Fri137e98926fc.exe

    Filesize

    3.8MB

    MD5

    a128f3490a3d62ec1f7c969771c9cb52

    SHA1

    73f71a45f68e317222ac704d30319fcbecdb8476

    SHA256

    4040769cb6796be3af8bd8b2c9d4be701155760766fddbd015b0bcb2b4fca52a

    SHA512

    ccf34b78a577bc12542e774574d21f3673710868705bf2c0ecdf6ce3414406ec63d5f65e3ff125f65e749a54d64e642492ee53d91a04d309228e2a73d7ab0a19

  • C:\Users\Admin\AppData\Local\Temp\7zS08841457\6246f7a94bb5c_Fri136aafed62.exe

    Filesize

    252KB

    MD5

    8daa50a23acd7af738f176b2590e94c6

    SHA1

    2d58cb919ea524591bc6a08ff3fe77ae0db6221f

    SHA256

    4d24517c0f7a7e07c07d3f4b819cd5f5165c7044bcc932e51ba39f082847d19a

    SHA512

    3aca67a8d507d4029fb24b8f0b9a7aef57f70a16c833a9cfb2b51022fad4e54507edea21c2a4888843c6a9e4f6513ff49c0296dc09b45328d1c8300b9f90de87

  • C:\Users\Admin\AppData\Local\Temp\7zS08841457\6246f7aa4b416_Fri133529ec01f5.exe

    Filesize

    383KB

    MD5

    0a8d60731fe6e1dd5ab0e42ec68dd655

    SHA1

    5e0adf2c89c6dbf83f19e79d83b40402880884f9

    SHA256

    e0c54390047af2d8491d9fd8032f3b2dec88cd34eb854aff8fb118ee7bd03ef3

    SHA512

    58e96d65bf876d65372dd7c748933e2212676111e344ab749e4150dd3616eba140d2e128ef616aa8e0345c7db78e28c2157843c355e66cdc74c77f9c9e48a490

  • C:\Users\Admin\AppData\Local\Temp\7zS08841457\6246f7ab338f8_Fri13f726be9ff.exe

    Filesize

    1.6MB

    MD5

    79c79760259bd18332ca17a05dab283d

    SHA1

    b9afed2134363447d014b85c37820c5a44f33722

    SHA256

    e6eb127214bbef16c7372fbe85e1ba453f7aceee241398d2a8e0ec115c3625d3

    SHA512

    a4270de42d09caa42280b1a7538dc4e0897f17421987927ac8b37fde7e44f77feb9ce1386ffd594fe6262ebb817c2df5a2c20a4adb4b0261eae5d0b6a007aa06

  • C:\Users\Admin\AppData\Local\Temp\7zS08841457\6246f7ae19ce0_Fri13a868de1.exe

    Filesize

    1.7MB

    MD5

    9f2ba6cffd2e51c63f1f0bf153b87823

    SHA1

    a00e56425d201225c41b13f22a09fb4562bc1cf4

    SHA256

    30b2aac192d6bb77baf163dd16ee9c2b1e928d9ff62cbeee1ace6aa2d84d59e9

    SHA512

    b97b73f356319e59d95010ce06b578db0f5a1f84c7863c066b1982a8106f6c86769b003e2ffde00941ce74b9f15bca8990fbffe6b350ff4a40166bc0bf416c7d

  • C:\Users\Admin\AppData\Local\Temp\7zS08841457\6246f7af345ac_Fri13b7f06884.exe

    Filesize

    315KB

    MD5

    84e9047be9d225a784b8855640a6d034

    SHA1

    deadecb0340b58236fd4e6127b0a545c47e7393e

    SHA256

    40fd6365f236050b75bd96ad7cab07c6b6875ce2c76016499bed58e5a27ef0de

    SHA512

    8a721f423f61504bf0de5acedf37a5e48d8f8e7d74a547f1865904e168622a075d64f1bb7b2aa8f150a0eb0d1e035d342d5268b4ab460c18713ce6425330da50

  • C:\Users\Admin\AppData\Local\Temp\7zS08841457\libcurlpp.dll

    Filesize

    54KB

    MD5

    e6e578373c2e416289a8da55f1dc5e8e

    SHA1

    b601a229b66ec3d19c2369b36216c6f6eb1c063e

    SHA256

    43e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f

    SHA512

    9df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89

  • C:\Users\Admin\AppData\Local\Temp\7zS08841457\libgcc_s_dw2-1.dll

    Filesize

    113KB

    MD5

    9aec524b616618b0d3d00b27b6f51da1

    SHA1

    64264300801a353db324d11738ffed876550e1d3

    SHA256

    59a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e

    SHA512

    0648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0

  • C:\Users\Admin\AppData\Local\Temp\7zS08841457\libstdc++-6.dll

    Filesize

    647KB

    MD5

    5e279950775baae5fea04d2cc4526bcc

    SHA1

    8aef1e10031c3629512c43dd8b0b5d9060878453

    SHA256

    97de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87

    SHA512

    666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02

  • C:\Users\Admin\AppData\Local\Temp\7zS08841457\libwinpthread-1.dll

    Filesize

    69KB

    MD5

    1e0d62c34ff2e649ebc5c372065732ee

    SHA1

    fcfaa36ba456159b26140a43e80fbd7e9d9af2de

    SHA256

    509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723

    SHA512

    3653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61

  • \Users\Admin\AppData\Local\Temp\7zS08841457\libcurl.dll

    Filesize

    218KB

    MD5

    d09be1f47fd6b827c81a4812b4f7296f

    SHA1

    028ae3596c0790e6d7f9f2f3c8e9591527d267f7

    SHA256

    0de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e

    SHA512

    857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595

  • \Users\Admin\AppData\Local\Temp\7zS08841457\setup_install.exe

    Filesize

    2.1MB

    MD5

    955a80af149655652530e472782aaf79

    SHA1

    a581b2d53f8d2ca46458af201694789c0f501475

    SHA256

    c50bf0b1a0313c72b557df6a60fa9937873772d105084f68c83e4f74fff8ca47

    SHA512

    d610e8b64a445bf4306bcc980e6c3ead5ea898bbb8c03fa5f55202bf045042a28fdf15b9a8fd767131729f7b83c81c5b59a7a949a967d59370450b29e1268149

  • memory/2920-99-0x0000000064940000-0x0000000064959000-memory.dmp

    Filesize

    100KB

  • memory/2920-77-0x000000006B280000-0x000000006B2A6000-memory.dmp

    Filesize

    152KB

  • memory/2920-67-0x0000000064940000-0x0000000064959000-memory.dmp

    Filesize

    100KB

  • memory/2920-63-0x000000006FE40000-0x000000006FFC6000-memory.dmp

    Filesize

    1.5MB

  • memory/2920-100-0x000000006FE40000-0x000000006FFC6000-memory.dmp

    Filesize

    1.5MB

  • memory/2920-74-0x000000006FE40000-0x000000006FFC6000-memory.dmp

    Filesize

    1.5MB

  • memory/2920-76-0x000000006B280000-0x000000006B2A6000-memory.dmp

    Filesize

    152KB

  • memory/2920-98-0x000000006B440000-0x000000006B4CF000-memory.dmp

    Filesize

    572KB

  • memory/2920-97-0x000000006B280000-0x000000006B2A6000-memory.dmp

    Filesize

    152KB

  • memory/2920-95-0x000000006EB40000-0x000000006EB63000-memory.dmp

    Filesize

    140KB

  • memory/2920-91-0x0000000000400000-0x000000000051C000-memory.dmp

    Filesize

    1.1MB

  • memory/2920-66-0x000000006494A000-0x000000006494F000-memory.dmp

    Filesize

    20KB

  • memory/2920-57-0x000000006B440000-0x000000006B4CF000-memory.dmp

    Filesize

    572KB

  • memory/2920-70-0x000000006B440000-0x000000006B4CF000-memory.dmp

    Filesize

    572KB

  • memory/2920-71-0x000000006B440000-0x000000006B4CF000-memory.dmp

    Filesize

    572KB

  • memory/2920-54-0x000000006B280000-0x000000006B2A6000-memory.dmp

    Filesize

    152KB

  • memory/2920-72-0x000000006FE40000-0x000000006FFC6000-memory.dmp

    Filesize

    1.5MB

  • memory/2920-75-0x000000006FE40000-0x000000006FFC6000-memory.dmp

    Filesize

    1.5MB

  • memory/2920-69-0x000000006B440000-0x000000006B4CF000-memory.dmp

    Filesize

    572KB

  • memory/2920-68-0x0000000064940000-0x0000000064959000-memory.dmp

    Filesize

    100KB

  • memory/2920-73-0x000000006FE40000-0x000000006FFC6000-memory.dmp

    Filesize

    1.5MB