Analysis
-
max time kernel
91s -
max time network
94s -
platform
windows10_x64 -
resource
win10 -
submitted
10-07-2020 12:10
Static task
static1
Behavioral task
behavioral1
Sample
b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe
Resource
win7v200430
General
-
Target
b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe
-
Size
242KB
-
MD5
62231fa0b731bd0aac1c55bd8ed15898
-
SHA1
d3dd155f601bb80e417b9b0a6cf294215107af46
-
SHA256
b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3
-
SHA512
6539e010a88784c5c6c605038b2edb38c06d060543140e08c405025fd4c825f281e78993309a82dabb26148d5ad5eaf5eb0ea87f9fe95a520cd59d9c508c683c
Malware Config
Extracted
azorult
http://195.245.112.115/index.php
Extracted
oski
raymond.ug
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
pid Process 3932 osaz.exe 2004 osaz.exe -
Loads dropped DLL 3 IoCs
pid Process 2004 osaz.exe 2004 osaz.exe 2004 osaz.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4016 set thread context of 3744 4016 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe 69 PID 3932 set thread context of 2004 3932 osaz.exe 76 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 1 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString osaz.exe -
Kills process with taskkill 1 IoCs
pid Process 2124 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4016 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe 4016 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4016 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe Token: SeDebugPrivilege 2124 taskkill.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 4016 wrote to memory of 3932 4016 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe 67 PID 4016 wrote to memory of 3932 4016 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe 67 PID 4016 wrote to memory of 3932 4016 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe 67 PID 4016 wrote to memory of 3796 4016 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe 68 PID 4016 wrote to memory of 3796 4016 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe 68 PID 4016 wrote to memory of 3796 4016 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe 68 PID 4016 wrote to memory of 3744 4016 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe 69 PID 4016 wrote to memory of 3744 4016 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe 69 PID 4016 wrote to memory of 3744 4016 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe 69 PID 4016 wrote to memory of 3744 4016 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe 69 PID 4016 wrote to memory of 3744 4016 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe 69 PID 4016 wrote to memory of 3744 4016 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe 69 PID 4016 wrote to memory of 3744 4016 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe 69 PID 4016 wrote to memory of 3744 4016 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe 69 PID 4016 wrote to memory of 3744 4016 b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe 69 PID 3932 wrote to memory of 2004 3932 osaz.exe 76 PID 3932 wrote to memory of 2004 3932 osaz.exe 76 PID 3932 wrote to memory of 2004 3932 osaz.exe 76 PID 3932 wrote to memory of 2004 3932 osaz.exe 76 PID 3932 wrote to memory of 2004 3932 osaz.exe 76 PID 3932 wrote to memory of 2004 3932 osaz.exe 76 PID 3932 wrote to memory of 2004 3932 osaz.exe 76 PID 3932 wrote to memory of 2004 3932 osaz.exe 76 PID 3932 wrote to memory of 2004 3932 osaz.exe 76 PID 2004 wrote to memory of 2676 2004 osaz.exe 77 PID 2004 wrote to memory of 2676 2004 osaz.exe 77 PID 2004 wrote to memory of 2676 2004 osaz.exe 77 PID 2676 wrote to memory of 2124 2676 cmd.exe 79 PID 2676 wrote to memory of 2124 2676 cmd.exe 79 PID 2676 wrote to memory of 2124 2676 cmd.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe"C:\Users\Admin\AppData\Local\Temp\b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\osaz.exe"C:\Users\Admin\AppData\Local\Temp\osaz.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\osaz.exe"{path}"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /pid 2004 & erase C:\Users\Admin\AppData\Local\Temp\osaz.exe & RD /S /Q C:\\ProgramData\\651497815684615\\* & exit4⤵
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\taskkill.exetaskkill /pid 20045⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2124
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe"{path}"2⤵PID:3796
-
-
C:\Users\Admin\AppData\Local\Temp\b699a2766f106ff77377780bad431b72ef1748bf989e09f2b82fb73cf30cbde3.exe"{path}"2⤵PID:3744
-