Analysis
-
max time kernel
128s -
max time network
149s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
09-07-2020 14:52
Static task
static1
Behavioral task
behavioral1
Sample
023cb7d67ab73b5025b038b8aaca2e38.exe
Resource
win7
Behavioral task
behavioral2
Sample
023cb7d67ab73b5025b038b8aaca2e38.exe
Resource
win10v200430
General
-
Target
023cb7d67ab73b5025b038b8aaca2e38.exe
-
Size
837KB
-
MD5
023cb7d67ab73b5025b038b8aaca2e38
-
SHA1
2413cf5dea7556a174d55af552eb0da9b53348c0
-
SHA256
bc26d6c58c878cead6d2a9597a81ad968b7f1112dcf2b1cb79b1f5d26e695e25
-
SHA512
ec42af673774a4332e68a0ec1ddc311d6bcab7c8f7082b01b1397afa1766677833912832eeb7f77b7728671f64b1606239b2e72f240d23bc9376e73fc37548f5
Malware Config
Extracted
azorult
http://82.165.75.233/index.php
Signatures
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
023cb7d67ab73b5025b038b8aaca2e38.exepid process 3216 023cb7d67ab73b5025b038b8aaca2e38.exe -
Loads dropped DLL 4 IoCs
Processes:
023cb7d67ab73b5025b038b8aaca2e38.exepid process 1208 023cb7d67ab73b5025b038b8aaca2e38.exe 1208 023cb7d67ab73b5025b038b8aaca2e38.exe 1208 023cb7d67ab73b5025b038b8aaca2e38.exe 1208 023cb7d67ab73b5025b038b8aaca2e38.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
023cb7d67ab73b5025b038b8aaca2e38.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 023cb7d67ab73b5025b038b8aaca2e38.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 023cb7d67ab73b5025b038b8aaca2e38.exe -
Checks for installed software on the system 1 TTPs 31 IoCs
Processes:
023cb7d67ab73b5025b038b8aaca2e38.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName 023cb7d67ab73b5025b038b8aaca2e38.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName 023cb7d67ab73b5025b038b8aaca2e38.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayName 023cb7d67ab73b5025b038b8aaca2e38.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayName 023cb7d67ab73b5025b038b8aaca2e38.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName 023cb7d67ab73b5025b038b8aaca2e38.exe Key enumerated \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall 023cb7d67ab73b5025b038b8aaca2e38.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName 023cb7d67ab73b5025b038b8aaca2e38.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName 023cb7d67ab73b5025b038b8aaca2e38.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName 023cb7d67ab73b5025b038b8aaca2e38.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName 023cb7d67ab73b5025b038b8aaca2e38.exe Key opened \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall 023cb7d67ab73b5025b038b8aaca2e38.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName 023cb7d67ab73b5025b038b8aaca2e38.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName 023cb7d67ab73b5025b038b8aaca2e38.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DisplayName 023cb7d67ab73b5025b038b8aaca2e38.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall 023cb7d67ab73b5025b038b8aaca2e38.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName 023cb7d67ab73b5025b038b8aaca2e38.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayName 023cb7d67ab73b5025b038b8aaca2e38.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName 023cb7d67ab73b5025b038b8aaca2e38.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName 023cb7d67ab73b5025b038b8aaca2e38.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayName 023cb7d67ab73b5025b038b8aaca2e38.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName 023cb7d67ab73b5025b038b8aaca2e38.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall 023cb7d67ab73b5025b038b8aaca2e38.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime\DisplayName 023cb7d67ab73b5025b038b8aaca2e38.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName 023cb7d67ab73b5025b038b8aaca2e38.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayName 023cb7d67ab73b5025b038b8aaca2e38.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName 023cb7d67ab73b5025b038b8aaca2e38.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName 023cb7d67ab73b5025b038b8aaca2e38.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2\DisplayName 023cb7d67ab73b5025b038b8aaca2e38.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayName 023cb7d67ab73b5025b038b8aaca2e38.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayName 023cb7d67ab73b5025b038b8aaca2e38.exe Key value queried \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe\DisplayName 023cb7d67ab73b5025b038b8aaca2e38.exe -
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
023cb7d67ab73b5025b038b8aaca2e38.exedescription pid process target process PID 3216 wrote to memory of 1208 3216 023cb7d67ab73b5025b038b8aaca2e38.exe 023cb7d67ab73b5025b038b8aaca2e38.exe PID 3216 wrote to memory of 1208 3216 023cb7d67ab73b5025b038b8aaca2e38.exe 023cb7d67ab73b5025b038b8aaca2e38.exe PID 3216 wrote to memory of 1208 3216 023cb7d67ab73b5025b038b8aaca2e38.exe 023cb7d67ab73b5025b038b8aaca2e38.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
023cb7d67ab73b5025b038b8aaca2e38.exedescription pid process target process PID 3216 set thread context of 1208 3216 023cb7d67ab73b5025b038b8aaca2e38.exe 023cb7d67ab73b5025b038b8aaca2e38.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
023cb7d67ab73b5025b038b8aaca2e38.exe023cb7d67ab73b5025b038b8aaca2e38.exepid process 3216 023cb7d67ab73b5025b038b8aaca2e38.exe 3216 023cb7d67ab73b5025b038b8aaca2e38.exe 1208 023cb7d67ab73b5025b038b8aaca2e38.exe 1208 023cb7d67ab73b5025b038b8aaca2e38.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\023cb7d67ab73b5025b038b8aaca2e38.exe"C:\Users\Admin\AppData\Local\Temp\023cb7d67ab73b5025b038b8aaca2e38.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\023cb7d67ab73b5025b038b8aaca2e38.exe"C:\Users\Admin\AppData\Local\Temp\023cb7d67ab73b5025b038b8aaca2e38.exe"2⤵
- Loads dropped DLL
- Checks processor information in registry
- Checks for installed software on the system
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
memory/1208-0-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1208-1-0x000000000041A1F8-mapping.dmp
-
memory/1208-2-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB