Analysis
- max time kernel
115s - max time network
118s - platform
windows10_x64 - resource
win10 - submitted
13/07/2020, 12:10
Static task
static1
Behavioral task
behavioral1
Sample
12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target 12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589.exe
- Size 211KB
- Sample200713-da72551tnj
- SHA256 12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589
- MD5 ae45cb818157138c24bae1d53018da0f
- SHA1 0221a4ed545e1095a6cf0d7ba06d08d827d22207
- SHA512 e3ec8b54ec37437656e48d02bfa19d1db218d92e710263fa8602467592c5f8432213921086a69fb6d5a78a77ba213143b2ec3d6b90651268e43eb7647dab8b62
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
azorult
C2
-
http://www.eryamanrehber.com/wp-pic/index.php
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3292 set thread context of 2992 3292 12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589.exe 68 - Loads dropped DLL 4 IoCs
pid Process 3648 tmp.exe 3648 tmp.exe 3648 tmp.exe 3648 tmp.exe - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 tmp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString tmp.exe - NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier cmd.exe - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 3292 12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589.exe 3292 12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589.exe 2888 WerFault.exe 2888 WerFault.exe 2888 WerFault.exe 2888 WerFault.exe 2888 WerFault.exe 2888 WerFault.exe 2888 WerFault.exe 2888 WerFault.exe 2888 WerFault.exe 2888 WerFault.exe 2888 WerFault.exe 2888 WerFault.exe 2888 WerFault.exe 2888 WerFault.exe 3648 tmp.exe 3648 tmp.exe - Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 2888 created 2992 2888 WerFault.exe 68 - Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
- Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3292 12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589.exe Token: SeRestorePrivilege 2888 WerFault.exe Token: SeBackupPrivilege 2888 WerFault.exe Token: SeDebugPrivilege 2888 WerFault.exe - Program crash 1 IoCs
pid pid_target Process procid_target 2888 2992 WerFault.exe 68 - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 3292 wrote to memory of 3648 3292 12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589.exe 67 PID 3292 wrote to memory of 3648 3292 12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589.exe 67 PID 3292 wrote to memory of 3648 3292 12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589.exe 67 PID 3292 wrote to memory of 2992 3292 12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589.exe 68 PID 3292 wrote to memory of 2992 3292 12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589.exe 68 PID 3292 wrote to memory of 2992 3292 12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589.exe 68 PID 3292 wrote to memory of 2992 3292 12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589.exe 68 PID 3292 wrote to memory of 2992 3292 12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589.exe 68 PID 3292 wrote to memory of 2992 3292 12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589.exe 68 PID 3292 wrote to memory of 2992 3292 12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589.exe 68 PID 3292 wrote to memory of 2992 3292 12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589.exe 68 PID 3292 wrote to memory of 2992 3292 12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589.exe 68 PID 3292 wrote to memory of 416 3292 12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589.exe 71 PID 3292 wrote to memory of 416 3292 12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589.exe 71 PID 3292 wrote to memory of 416 3292 12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589.exe 71 PID 3292 wrote to memory of 852 3292 12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589.exe 73 PID 3292 wrote to memory of 852 3292 12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589.exe 73 PID 3292 wrote to memory of 852 3292 12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589.exe 73 PID 852 wrote to memory of 1032 852 cmd.exe 75 PID 852 wrote to memory of 1032 852 cmd.exe 75 PID 852 wrote to memory of 1032 852 cmd.exe 75 PID 3292 wrote to memory of 1220 3292 12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589.exe 76 PID 3292 wrote to memory of 1220 3292 12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589.exe 76 PID 3292 wrote to memory of 1220 3292 12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589.exe 76 PID 3648 wrote to memory of 3356 3648 tmp.exe 78 PID 3648 wrote to memory of 3356 3648 tmp.exe 78 PID 3648 wrote to memory of 3356 3648 tmp.exe 78 PID 3356 wrote to memory of 2288 3356 cmd.exe 80 PID 3356 wrote to memory of 2288 3356 cmd.exe 80 PID 3356 wrote to memory of 2288 3356 cmd.exe 80 - Checks for installed software on the system 1 TTPs 31 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName tmp.exe Key enumerated \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall tmp.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName tmp.exe Key opened \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayName tmp.exe Key value queried \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe\DisplayName tmp.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName tmp.exe - Delays execution with timeout.exe 1 IoCs
pid Process 2288 timeout.exe - Executes dropped EXE 2 IoCs
pid Process 3648 tmp.exe 2992 svhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589.exe"C:\Users\Admin\AppData\Local\Temp\12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Checks for installed software on the system
- Executes dropped EXE
PID:3648 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "tmp.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 34⤵
- Delays execution with timeout.exe
PID:2288
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"2⤵
- Executes dropped EXE
PID:2992 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 3243⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Program crash
PID:2888
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589.exe" "%temp%\FolderN\name.exe" /Y2⤵PID:416
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f2⤵
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f3⤵PID:1032
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier2⤵
- NTFS ADS
PID:1220
-