Analysis
-
max time kernel
146s -
max time network
91s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
10-07-2020 12:10
Static task
static1
Behavioral task
behavioral1
Sample
b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe
Resource
win7v200430
General
-
Target
b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe
-
Size
242KB
-
MD5
62231fa0b731bd0aac1c55bd8ed15898
-
SHA1
d3dd155f601bb80e417b9b0a6cf294215107af46
-
SHA256
b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3
-
SHA512
6539e010a88784c5c6c605038b2edb38c06d060543140e08c405025fd4c825f281e78993309a82dabb26148d5ad5eaf5eb0ea87f9fe95a520cd59d9c508c683c
Malware Config
Extracted
azorult
http://195.245.112.115/index.php
Extracted
oski
raymond.ug
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
pid Process 1784 osaz.exe 1924 osaz.exe -
Loads dropped DLL 7 IoCs
pid Process 288 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe 1784 osaz.exe 1924 osaz.exe 1924 osaz.exe 1924 osaz.exe 1924 osaz.exe 1924 osaz.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 288 set thread context of 520 288 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe 27 PID 1784 set thread context of 1924 1784 osaz.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 1 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString osaz.exe -
Kills process with taskkill 1 IoCs
pid Process 1640 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1640 taskkill.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 288 wrote to memory of 1784 288 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe 26 PID 288 wrote to memory of 1784 288 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe 26 PID 288 wrote to memory of 1784 288 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe 26 PID 288 wrote to memory of 1784 288 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe 26 PID 288 wrote to memory of 520 288 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe 27 PID 288 wrote to memory of 520 288 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe 27 PID 288 wrote to memory of 520 288 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe 27 PID 288 wrote to memory of 520 288 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe 27 PID 288 wrote to memory of 520 288 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe 27 PID 288 wrote to memory of 520 288 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe 27 PID 288 wrote to memory of 520 288 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe 27 PID 288 wrote to memory of 520 288 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe 27 PID 288 wrote to memory of 520 288 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe 27 PID 288 wrote to memory of 520 288 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe 27 PID 1784 wrote to memory of 1924 1784 osaz.exe 30 PID 1784 wrote to memory of 1924 1784 osaz.exe 30 PID 1784 wrote to memory of 1924 1784 osaz.exe 30 PID 1784 wrote to memory of 1924 1784 osaz.exe 30 PID 1784 wrote to memory of 1924 1784 osaz.exe 30 PID 1784 wrote to memory of 1924 1784 osaz.exe 30 PID 1784 wrote to memory of 1924 1784 osaz.exe 30 PID 1784 wrote to memory of 1924 1784 osaz.exe 30 PID 1784 wrote to memory of 1924 1784 osaz.exe 30 PID 1784 wrote to memory of 1924 1784 osaz.exe 30 PID 1924 wrote to memory of 1464 1924 osaz.exe 32 PID 1924 wrote to memory of 1464 1924 osaz.exe 32 PID 1924 wrote to memory of 1464 1924 osaz.exe 32 PID 1924 wrote to memory of 1464 1924 osaz.exe 32 PID 1464 wrote to memory of 1640 1464 cmd.exe 34 PID 1464 wrote to memory of 1640 1464 cmd.exe 34 PID 1464 wrote to memory of 1640 1464 cmd.exe 34 PID 1464 wrote to memory of 1640 1464 cmd.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe"C:\Users\Admin\AppData\Local\Temp\b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:288 -
C:\Users\Admin\AppData\Local\Temp\osaz.exe"C:\Users\Admin\AppData\Local\Temp\osaz.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\osaz.exe"{path}"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /pid 1924 & erase C:\Users\Admin\AppData\Local\Temp\osaz.exe & RD /S /Q C:\\ProgramData\\461210471157435\\* & exit4⤵
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\taskkill.exetaskkill /pid 19245⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1640
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe"{path}"2⤵PID:520
-