Analysis
- max time kernel
6s - max time network
150s - platform
windows7_x64 - resource
win7v20201028 - submitted
09/11/2020, 20:44
General
- Target d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe
- Size 2.0MB
- Sample201109-ea3sdrf1ae
- SHA256 d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd
Malware Config
Extracted
-
azorult
-
http://0x21.in:8000/_az/
Signatures
- Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 8 IoCs
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext 2 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of WriteProcessMemory 25 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe"C:\Users\Admin\AppData\Local\Temp\d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵
- Maps connected drives based on registry
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe"C:\Users\Admin\AppData\Local\Temp\d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe"2⤵
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/676-37-0x0000000000B30000-0x0000000000B41000-memory.dmp
memory/676-57-0x0000000002820000-0x0000000002831000-memory.dmp
memory/936-29-0x0000000000A70000-0x0000000000A71000-memory.dmp
memory/936-28-0x00000000744B0000-0x0000000074B9E000-memory.dmp
memory/1168-17-0x00000000744B0000-0x0000000074B9E000-memory.dmp
memory/1168-21-0x0000000000DB0000-0x0000000000DB1000-memory.dmp
memory/1248-91-0x0000000000270000-0x000000000030C000-memory.dmp
memory/1352-86-0x00000000744B0000-0x0000000074B9E000-memory.dmp
memory/1352-88-0x0000000000B90000-0x0000000000B91000-memory.dmp
memory/1568-18-0x00000000000F0000-0x000000000018C000-memory.dmp
memory/1724-19-0x000007FEF6790000-0x000007FEF6A0A000-memory.dmp
memory/1928-62-0x00000000744B0000-0x0000000074B9E000-memory.dmp
memory/1992-14-0x0000000000080000-0x00000000000A0000-memory.dmp