Analysis
-
max time kernel
65s -
max time network
116s -
platform
windows10_x64 -
resource
win10 -
submitted
13-07-2020 06:58
Static task
static1
Behavioral task
behavioral1
Sample
MTIR17463892_7129937362_204637742048561.PDF.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
MTIR17463892_7129937362_204637742048561.PDF.exe
Resource
win10
General
-
Target
MTIR17463892_7129937362_204637742048561.PDF.exe
-
Size
211KB
-
MD5
ae45cb818157138c24bae1d53018da0f
-
SHA1
0221a4ed545e1095a6cf0d7ba06d08d827d22207
-
SHA256
12826d5302af642e1152b7b65718d7bcd1deca268630fa61444f131575795589
-
SHA512
e3ec8b54ec37437656e48d02bfa19d1db218d92e710263fa8602467592c5f8432213921086a69fb6d5a78a77ba213143b2ec3d6b90651268e43eb7647dab8b62
Malware Config
Extracted
azorult
http://www.eryamanrehber.com/wp-pic/index.php
Signatures
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3104 timeout.exe -
NTFS ADS 1 IoCs
Processes:
cmd.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier cmd.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
MTIR17463892_7129937362_204637742048561.PDF.execmd.exetmp.execmd.exedescription pid process target process PID 3588 wrote to memory of 3812 3588 MTIR17463892_7129937362_204637742048561.PDF.exe tmp.exe PID 3588 wrote to memory of 3812 3588 MTIR17463892_7129937362_204637742048561.PDF.exe tmp.exe PID 3588 wrote to memory of 3812 3588 MTIR17463892_7129937362_204637742048561.PDF.exe tmp.exe PID 3588 wrote to memory of 4004 3588 MTIR17463892_7129937362_204637742048561.PDF.exe svhost.exe PID 3588 wrote to memory of 4004 3588 MTIR17463892_7129937362_204637742048561.PDF.exe svhost.exe PID 3588 wrote to memory of 4004 3588 MTIR17463892_7129937362_204637742048561.PDF.exe svhost.exe PID 3588 wrote to memory of 4004 3588 MTIR17463892_7129937362_204637742048561.PDF.exe svhost.exe PID 3588 wrote to memory of 4004 3588 MTIR17463892_7129937362_204637742048561.PDF.exe svhost.exe PID 3588 wrote to memory of 4004 3588 MTIR17463892_7129937362_204637742048561.PDF.exe svhost.exe PID 3588 wrote to memory of 4004 3588 MTIR17463892_7129937362_204637742048561.PDF.exe svhost.exe PID 3588 wrote to memory of 4004 3588 MTIR17463892_7129937362_204637742048561.PDF.exe svhost.exe PID 3588 wrote to memory of 4004 3588 MTIR17463892_7129937362_204637742048561.PDF.exe svhost.exe PID 3588 wrote to memory of 3844 3588 MTIR17463892_7129937362_204637742048561.PDF.exe cmd.exe PID 3588 wrote to memory of 3844 3588 MTIR17463892_7129937362_204637742048561.PDF.exe cmd.exe PID 3588 wrote to memory of 3844 3588 MTIR17463892_7129937362_204637742048561.PDF.exe cmd.exe PID 3588 wrote to memory of 1928 3588 MTIR17463892_7129937362_204637742048561.PDF.exe cmd.exe PID 3588 wrote to memory of 1928 3588 MTIR17463892_7129937362_204637742048561.PDF.exe cmd.exe PID 3588 wrote to memory of 1928 3588 MTIR17463892_7129937362_204637742048561.PDF.exe cmd.exe PID 1928 wrote to memory of 3572 1928 cmd.exe reg.exe PID 1928 wrote to memory of 3572 1928 cmd.exe reg.exe PID 1928 wrote to memory of 3572 1928 cmd.exe reg.exe PID 3588 wrote to memory of 1672 3588 MTIR17463892_7129937362_204637742048561.PDF.exe cmd.exe PID 3588 wrote to memory of 1672 3588 MTIR17463892_7129937362_204637742048561.PDF.exe cmd.exe PID 3588 wrote to memory of 1672 3588 MTIR17463892_7129937362_204637742048561.PDF.exe cmd.exe PID 3812 wrote to memory of 968 3812 tmp.exe cmd.exe PID 3812 wrote to memory of 968 3812 tmp.exe cmd.exe PID 3812 wrote to memory of 968 3812 tmp.exe cmd.exe PID 968 wrote to memory of 3104 968 cmd.exe timeout.exe PID 968 wrote to memory of 3104 968 cmd.exe timeout.exe PID 968 wrote to memory of 3104 968 cmd.exe timeout.exe -
Executes dropped EXE 2 IoCs
Processes:
tmp.exesvhost.exepid process 3812 tmp.exe 4004 svhost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
MTIR17463892_7129937362_204637742048561.PDF.exedescription pid process target process PID 3588 set thread context of 4004 3588 MTIR17463892_7129937362_204637742048561.PDF.exe svhost.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
tmp.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 tmp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString tmp.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
MTIR17463892_7129937362_204637742048561.PDF.exetmp.exepid process 3588 MTIR17463892_7129937362_204637742048561.PDF.exe 3588 MTIR17463892_7129937362_204637742048561.PDF.exe 3812 tmp.exe 3812 tmp.exe -
Loads dropped DLL 4 IoCs
Processes:
tmp.exepid process 3812 tmp.exe 3812 tmp.exe 3812 tmp.exe 3812 tmp.exe -
Checks for installed software on the system 1 TTPs 31 IoCs
Processes:
tmp.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WIC\DisplayName tmp.exe Key opened \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2151757\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2544655\DisplayName tmp.exe Key enumerated \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2467173\DisplayName tmp.exe Key value queried \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Uninstall\OneDriveSetup.exe\DisplayName tmp.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall tmp.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2565063\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2524860\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB2549743\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}.KB982573\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{4A03706F-666A-4037-7777-5F2748764D10}\DisplayName tmp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{f4220b74-9edd-4ded-bc8b-0342c1e164d8}\DisplayName tmp.exe -
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MTIR17463892_7129937362_204637742048561.PDF.exedescription pid process Token: SeDebugPrivilege 3588 MTIR17463892_7129937362_204637742048561.PDF.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MTIR17463892_7129937362_204637742048561.PDF.exe"C:\Users\Admin\AppData\Local\Temp\MTIR17463892_7129937362_204637742048561.PDF.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Loads dropped DLL
- Checks for installed software on the system
PID:3812 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "tmp.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 34⤵
- Delays execution with timeout.exe
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"2⤵
- Executes dropped EXE
PID:4004 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/MTIR17463892_7129937362_204637742048561.PDF.exe" "%temp%\FolderN\name.exe" /Y2⤵PID:3844
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f3⤵PID:3572
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier2⤵
- NTFS ADS
PID:1672
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe
-
\Users\Admin\AppData\Local\Temp\2fda\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\2fda\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\2fda\nss3.dll
-
\Users\Admin\AppData\Local\Temp\2fda\vcruntime140.dll
-
memory/968-17-0x0000000000000000-mapping.dmp
-
memory/1672-12-0x0000000000000000-mapping.dmp
-
memory/1928-9-0x0000000000000000-mapping.dmp
-
memory/3104-18-0x0000000000000000-mapping.dmp
-
memory/3572-10-0x0000000000000000-mapping.dmp
-
memory/3812-0-0x0000000000000000-mapping.dmp
-
memory/3844-8-0x0000000000000000-mapping.dmp
-
memory/4004-7-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4004-4-0x000000000041A1F8-mapping.dmp
-
memory/4004-3-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB