Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7 -
submitted
07/07/2020, 06:04
Static task
static1
Behavioral task
behavioral1
Sample
PRODUCT LIST.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PRODUCT LIST.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
PRODUCT LIST.exe
-
Size
294KB
-
MD5
a42e195a8a3de45dc2bc88e33af006a4
-
SHA1
1ce81ed627893bb2cb4aa83b008dcd10c9203dae
-
SHA256
655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66
-
SHA512
2a08c7e3110e080d2377e7e25f7cc3f1ff936ceb5e59f5f763955578b68cafe10b8d260a6b3147d0bd6d127774a298181bca8ad6256f40a42318df31756de90c
Score
10/10
Malware Config
Extracted
Family
azorult
C2
http://217.160.254.33/index.php
Signatures
-
Checks for installed software on the system 1 TTPs 30 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayName PRODUCT LIST.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayName PRODUCT LIST.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}\DisplayName PRODUCT LIST.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall PRODUCT LIST.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName PRODUCT LIST.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName PRODUCT LIST.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayName PRODUCT LIST.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName PRODUCT LIST.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName PRODUCT LIST.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName PRODUCT LIST.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayName PRODUCT LIST.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName PRODUCT LIST.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayName PRODUCT LIST.exe Key opened \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall PRODUCT LIST.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName PRODUCT LIST.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName PRODUCT LIST.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName PRODUCT LIST.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName PRODUCT LIST.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayName PRODUCT LIST.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}\DisplayName PRODUCT LIST.exe Key opened \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall PRODUCT LIST.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName PRODUCT LIST.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName PRODUCT LIST.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName PRODUCT LIST.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName PRODUCT LIST.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName PRODUCT LIST.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName PRODUCT LIST.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName PRODUCT LIST.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayName PRODUCT LIST.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364\DisplayName PRODUCT LIST.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1496 wrote to memory of 740 1496 PRODUCT LIST.exe 24 PID 1496 wrote to memory of 740 1496 PRODUCT LIST.exe 24 PID 1496 wrote to memory of 740 1496 PRODUCT LIST.exe 24 PID 1496 wrote to memory of 740 1496 PRODUCT LIST.exe 24 PID 1496 wrote to memory of 740 1496 PRODUCT LIST.exe 24 PID 1496 wrote to memory of 740 1496 PRODUCT LIST.exe 24 PID 1496 wrote to memory of 740 1496 PRODUCT LIST.exe 24 PID 1496 wrote to memory of 740 1496 PRODUCT LIST.exe 24 PID 1496 wrote to memory of 740 1496 PRODUCT LIST.exe 24 PID 1496 wrote to memory of 740 1496 PRODUCT LIST.exe 24 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1496 set thread context of 740 1496 PRODUCT LIST.exe 24 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 740 PRODUCT LIST.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 PRODUCT LIST.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString PRODUCT LIST.exe -
Loads dropped DLL 16 IoCs
pid Process 740 PRODUCT LIST.exe 740 PRODUCT LIST.exe 740 PRODUCT LIST.exe 740 PRODUCT LIST.exe 740 PRODUCT LIST.exe 740 PRODUCT LIST.exe 740 PRODUCT LIST.exe 740 PRODUCT LIST.exe 740 PRODUCT LIST.exe 740 PRODUCT LIST.exe 740 PRODUCT LIST.exe 740 PRODUCT LIST.exe 740 PRODUCT LIST.exe 740 PRODUCT LIST.exe 740 PRODUCT LIST.exe 740 PRODUCT LIST.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
Processes
-
C:\Users\Admin\AppData\Local\Temp\PRODUCT LIST.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCT LIST.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\PRODUCT LIST.exe"{path}"2⤵
- Checks for installed software on the system
- Suspicious behavior: EnumeratesProcesses
- Checks processor information in registry
- Loads dropped DLL
PID:740
-