Analysis
-
max time kernel
136s -
max time network
32s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
13-07-2020 06:58
Static task
static1
Behavioral task
behavioral1
Sample
MTIR17463892_7129937362_204637742048561.PDF.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
MTIR17463892_7129937362_204637742048561.PDF.exe
Resource
win10
General
-
Target
MTIR17463892_7129937362_204637742048561.PDF.exe
-
Size
211KB
-
MD5
ae45cb818157138c24bae1d53018da0f
-
SHA1
0221a4ed545e1095a6cf0d7ba06d08d827d22207
-
SHA256
12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589
-
SHA512
e3ec8b54ec37437656e48d02bfa19d1db218d92e710263fa8602467592c5f8432213921086a69fb6d5a78a77ba213143b2ec3d6b90651268e43eb7647dab8b62
Malware Config
Extracted
azorult
http://www.eryamanrehber.com/wp-pic/index.php
Signatures
-
Loads dropped DLL 20 IoCs
Processes:
MTIR17463892_7129937362_204637742048561.PDF.exetmp.exepid process 1032 MTIR17463892_7129937362_204637742048561.PDF.exe 1032 MTIR17463892_7129937362_204637742048561.PDF.exe 1032 MTIR17463892_7129937362_204637742048561.PDF.exe 1032 MTIR17463892_7129937362_204637742048561.PDF.exe 1088 tmp.exe 1088 tmp.exe 1088 tmp.exe 1088 tmp.exe 1088 tmp.exe 1088 tmp.exe 1088 tmp.exe 1088 tmp.exe 1088 tmp.exe 1088 tmp.exe 1088 tmp.exe 1088 tmp.exe 1088 tmp.exe 1088 tmp.exe 1088 tmp.exe 1088 tmp.exe -
Executes dropped EXE 2 IoCs
Processes:
tmp.exesvhost.exepid process 1088 tmp.exe 1492 svhost.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Checks for installed software on the system 1 TTPs 30 IoCs
Processes:
tmp.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName tmp.exe Key opened \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName tmp.exe Key opened \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{00203668-8170-44A0-BE44-B632FA4D780F}\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{92FB6C44-E685-45AD-9B20-CADF4CABA132}.KB4087364\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-A90000000001}\DisplayName tmp.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Adobe AIR\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{BB8B979E-E336-47E7-96BC-1031C1B94561}\DisplayName tmp.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
MTIR17463892_7129937362_204637742048561.PDF.exedescription pid process target process PID 1032 set thread context of 1492 1032 MTIR17463892_7129937362_204637742048561.PDF.exe svhost.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
NTFS ADS 1 IoCs
Processes:
cmd.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier cmd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MTIR17463892_7129937362_204637742048561.PDF.exedescription pid process Token: SeDebugPrivilege 1032 MTIR17463892_7129937362_204637742048561.PDF.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
MTIR17463892_7129937362_204637742048561.PDF.exetmp.exepid process 1032 MTIR17463892_7129937362_204637742048561.PDF.exe 1032 MTIR17463892_7129937362_204637742048561.PDF.exe 1088 tmp.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
MTIR17463892_7129937362_204637742048561.PDF.execmd.exetmp.execmd.exedescription pid process target process PID 1032 wrote to memory of 1088 1032 MTIR17463892_7129937362_204637742048561.PDF.exe tmp.exe PID 1032 wrote to memory of 1088 1032 MTIR17463892_7129937362_204637742048561.PDF.exe tmp.exe PID 1032 wrote to memory of 1088 1032 MTIR17463892_7129937362_204637742048561.PDF.exe tmp.exe PID 1032 wrote to memory of 1088 1032 MTIR17463892_7129937362_204637742048561.PDF.exe tmp.exe PID 1032 wrote to memory of 1492 1032 MTIR17463892_7129937362_204637742048561.PDF.exe svhost.exe PID 1032 wrote to memory of 1492 1032 MTIR17463892_7129937362_204637742048561.PDF.exe svhost.exe PID 1032 wrote to memory of 1492 1032 MTIR17463892_7129937362_204637742048561.PDF.exe svhost.exe PID 1032 wrote to memory of 1492 1032 MTIR17463892_7129937362_204637742048561.PDF.exe svhost.exe PID 1032 wrote to memory of 1492 1032 MTIR17463892_7129937362_204637742048561.PDF.exe svhost.exe PID 1032 wrote to memory of 1492 1032 MTIR17463892_7129937362_204637742048561.PDF.exe svhost.exe PID 1032 wrote to memory of 1492 1032 MTIR17463892_7129937362_204637742048561.PDF.exe svhost.exe PID 1032 wrote to memory of 1492 1032 MTIR17463892_7129937362_204637742048561.PDF.exe svhost.exe PID 1032 wrote to memory of 1492 1032 MTIR17463892_7129937362_204637742048561.PDF.exe svhost.exe PID 1032 wrote to memory of 1492 1032 MTIR17463892_7129937362_204637742048561.PDF.exe svhost.exe PID 1032 wrote to memory of 1820 1032 MTIR17463892_7129937362_204637742048561.PDF.exe cmd.exe PID 1032 wrote to memory of 1820 1032 MTIR17463892_7129937362_204637742048561.PDF.exe cmd.exe PID 1032 wrote to memory of 1820 1032 MTIR17463892_7129937362_204637742048561.PDF.exe cmd.exe PID 1032 wrote to memory of 1820 1032 MTIR17463892_7129937362_204637742048561.PDF.exe cmd.exe PID 1032 wrote to memory of 1852 1032 MTIR17463892_7129937362_204637742048561.PDF.exe cmd.exe PID 1032 wrote to memory of 1852 1032 MTIR17463892_7129937362_204637742048561.PDF.exe cmd.exe PID 1032 wrote to memory of 1852 1032 MTIR17463892_7129937362_204637742048561.PDF.exe cmd.exe PID 1032 wrote to memory of 1852 1032 MTIR17463892_7129937362_204637742048561.PDF.exe cmd.exe PID 1852 wrote to memory of 1892 1852 cmd.exe reg.exe PID 1852 wrote to memory of 1892 1852 cmd.exe reg.exe PID 1852 wrote to memory of 1892 1852 cmd.exe reg.exe PID 1852 wrote to memory of 1892 1852 cmd.exe reg.exe PID 1032 wrote to memory of 1752 1032 MTIR17463892_7129937362_204637742048561.PDF.exe cmd.exe PID 1032 wrote to memory of 1752 1032 MTIR17463892_7129937362_204637742048561.PDF.exe cmd.exe PID 1032 wrote to memory of 1752 1032 MTIR17463892_7129937362_204637742048561.PDF.exe cmd.exe PID 1032 wrote to memory of 1752 1032 MTIR17463892_7129937362_204637742048561.PDF.exe cmd.exe PID 1088 wrote to memory of 1600 1088 tmp.exe cmd.exe PID 1088 wrote to memory of 1600 1088 tmp.exe cmd.exe PID 1088 wrote to memory of 1600 1088 tmp.exe cmd.exe PID 1088 wrote to memory of 1600 1088 tmp.exe cmd.exe PID 1600 wrote to memory of 1620 1600 cmd.exe timeout.exe PID 1600 wrote to memory of 1620 1600 cmd.exe timeout.exe PID 1600 wrote to memory of 1620 1600 cmd.exe timeout.exe PID 1600 wrote to memory of 1620 1600 cmd.exe timeout.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
tmp.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 tmp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString tmp.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1620 timeout.exe -
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
Processes
-
C:\Users\Admin\AppData\Local\Temp\MTIR17463892_7129937362_204637742048561.PDF.exe"C:\Users\Admin\AppData\Local\Temp\MTIR17463892_7129937362_204637742048561.PDF.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Loads dropped DLL
- Executes dropped EXE
- Checks for installed software on the system
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "tmp.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 34⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/MTIR17463892_7129937362_204637742048561.PDF.exe" "%temp%\FolderN\name.exe" /Y2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier2⤵
- NTFS ADS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe
-
\Users\Admin\AppData\Local\Temp\2fda\api-ms-win-crt-convert-l1-1-0.dll
-
\Users\Admin\AppData\Local\Temp\2fda\api-ms-win-crt-environment-l1-1-0.dll
-
\Users\Admin\AppData\Local\Temp\2fda\api-ms-win-crt-filesystem-l1-1-0.dll
-
\Users\Admin\AppData\Local\Temp\2fda\api-ms-win-crt-heap-l1-1-0.dll
-
\Users\Admin\AppData\Local\Temp\2fda\api-ms-win-crt-locale-l1-1-0.dll
-
\Users\Admin\AppData\Local\Temp\2fda\api-ms-win-crt-math-l1-1-0.dll
-
\Users\Admin\AppData\Local\Temp\2fda\api-ms-win-crt-multibyte-l1-1-0.dll
-
\Users\Admin\AppData\Local\Temp\2fda\api-ms-win-crt-runtime-l1-1-0.dll
-
\Users\Admin\AppData\Local\Temp\2fda\api-ms-win-crt-stdio-l1-1-0.dll
-
\Users\Admin\AppData\Local\Temp\2fda\api-ms-win-crt-string-l1-1-0.dll
-
\Users\Admin\AppData\Local\Temp\2fda\api-ms-win-crt-time-l1-1-0.dll
-
\Users\Admin\AppData\Local\Temp\2fda\api-ms-win-crt-utility-l1-1-0.dll
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
\Users\Admin\AppData\Local\Temp\FolderN\name.exe
-
\Users\Admin\AppData\Local\Temp\svhost.exe
-
\Users\Admin\AppData\Local\Temp\tmp.exe
-
\Users\Admin\AppData\Local\Temp\tmp.exe
-
memory/1088-2-0x0000000000000000-mapping.dmp
-
memory/1492-8-0x0000000000080000-0x00000000000A0000-memory.dmpFilesize
128KB
-
memory/1492-6-0x000000000041A1F8-mapping.dmp
-
memory/1492-5-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1600-31-0x0000000000000000-mapping.dmp
-
memory/1620-32-0x0000000000000000-mapping.dmp
-
memory/1752-14-0x0000000000000000-mapping.dmp
-
memory/1820-9-0x0000000000000000-mapping.dmp
-
memory/1852-10-0x0000000000000000-mapping.dmp
-
memory/1892-11-0x0000000000000000-mapping.dmp