Analysis
- max time kernel
4s - max time network
148s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:44
Static task
static1
Behavioral task
behavioral1
Sample
d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe
- Size 2.0MB
- Sample201109-ea3sdrf1ae
- SHA256 d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd
- MD5 00696c885b4edd39dc7def77f57a400c
- SHA1 029109f3e5956c873207c6c4e85339b4ae13aba5
- SHA512 1f163da770f14745d5ef6c3035b56dbb837e274af948dbd9de6e8b03069e64c767d2e7d9fcd8fb93aa1bb08b8a588c89ed352d12e923a126c5cd8b444c12327d
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
azorult
C2
-
http://0x21.in:8000/_az/
Signatures
- Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
- ServiceHost packer 35 IoCs
Detects ServiceHost packer used for .NET malware
resource yara_rule behavioral2/memory/2572-8-0x00000010FBF68000-mapping.dmp servicehost behavioral2/memory/1768-39-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1768-40-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1768-41-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1768-42-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1768-43-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1768-44-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1768-45-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1768-46-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1768-48-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1768-49-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1768-47-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1768-51-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1768-50-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1768-53-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1768-52-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1768-55-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1768-54-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1768-76-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1768-77-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1768-78-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1768-79-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1768-80-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1768-81-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1768-82-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1768-83-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1768-84-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1768-85-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1768-86-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1768-87-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1768-88-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1768-89-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1768-92-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1768-91-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1768-90-0x0000000000000000-mapping.dmp servicehost - Executes dropped EXE 2 IoCs
pid Process 2520 vnc.exe 3604 windef.exe - Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\y: d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe File opened (read-only) \??\z: d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe File opened (read-only) \??\g: d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe File opened (read-only) \??\l: d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe File opened (read-only) \??\s: d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe File opened (read-only) \??\t: d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe File opened (read-only) \??\u: d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe File opened (read-only) \??\p: d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe File opened (read-only) \??\r: d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe File opened (read-only) \??\v: d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe File opened (read-only) \??\w: d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe File opened (read-only) \??\m: d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe File opened (read-only) \??\n: d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe File opened (read-only) \??\o: d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe File opened (read-only) \??\a: d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe File opened (read-only) \??\f: d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe File opened (read-only) \??\h: d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe File opened (read-only) \??\j: d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe File opened (read-only) \??\k: d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe File opened (read-only) \??\x: d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe File opened (read-only) \??\b: d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe File opened (read-only) \??\e: d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe File opened (read-only) \??\i: d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe File opened (read-only) \??\q: d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 20 ip-api.com - Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 svchost.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2520 set thread context of 2572 2520 vnc.exe 78 PID 3412 set thread context of 192 3412 d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe 80 - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2284 schtasks.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3412 d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe 3412 d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe 3412 d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe 3412 d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2520 vnc.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 3412 wrote to memory of 2520 3412 d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe 75 PID 3412 wrote to memory of 2520 3412 d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe 75 PID 3412 wrote to memory of 2520 3412 d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe 75 PID 2520 wrote to memory of 2572 2520 vnc.exe 78 PID 2520 wrote to memory of 2572 2520 vnc.exe 78 PID 3412 wrote to memory of 3604 3412 d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe 79 PID 3412 wrote to memory of 3604 3412 d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe 79 PID 3412 wrote to memory of 3604 3412 d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe 79 PID 2520 wrote to memory of 2572 2520 vnc.exe 78 PID 2520 wrote to memory of 2572 2520 vnc.exe 78 PID 3412 wrote to memory of 192 3412 d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe 80 PID 3412 wrote to memory of 192 3412 d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe 80 PID 3412 wrote to memory of 192 3412 d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe 80 PID 3412 wrote to memory of 192 3412 d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe 80 PID 3412 wrote to memory of 192 3412 d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe 80 PID 3412 wrote to memory of 2284 3412 d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe 81 PID 3412 wrote to memory of 2284 3412 d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe 81 PID 3412 wrote to memory of 2284 3412 d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe 81 PID 2520 wrote to memory of 2572 2520 vnc.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe"C:\Users\Admin\AppData\Local\Temp\d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe"1⤵
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵
- Maps connected drives based on registry
PID:2572
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
PID:3604
-
-
C:\Users\Admin\AppData\Local\Temp\d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe"C:\Users\Admin\AppData\Local\Temp\d6031bb15fd16cac9b514985035e18f08f0beaaa0542a66274467cb66e76a8fd.exe"2⤵PID:192
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2284
-