Analysis
-
max time kernel
18s -
max time network
20s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 19:39
Static task
static1
Behavioral task
behavioral1
Sample
MTIR20283256_2101013335_20200507083759.PDF.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
MTIR20283256_2101013335_20200507083759.PDF.exe
Resource
win10v20201028
General
-
Target
MTIR20283256_2101013335_20200507083759.PDF.exe
-
Size
406KB
-
MD5
6c378a9a4067f1affdb254dfa96943da
-
SHA1
12911df0be6ae9f4292038e60c5aad41073c55fd
-
SHA256
fd975fd3af1f754bf7b03eca4ae29e3054f34f7176b26c2578efddde76947f70
-
SHA512
33dc7b3b743bc77efea699a3508b4fbe1f0707cd6ad38f9cba8a1257b4c881d5cf6212d3c3a8cf1e3efe46dadff55747b1dee0b6df8942e268891e2a3d8f3858
Malware Config
Extracted
azorult
http://ensaenerji.com/mep/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
CoreEntity .NET Packer 1 IoCs
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
Processes:
resource yara_rule behavioral1/memory/1848-3-0x0000000000430000-0x0000000000433000-memory.dmp coreentity -
Processes:
resource yara_rule behavioral1/memory/1848-4-0x0000000004630000-0x0000000004654000-memory.dmp rezer0 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
MTIR20283256_2101013335_20200507083759.PDF.exedescription pid process target process PID 1848 set thread context of 316 1848 MTIR20283256_2101013335_20200507083759.PDF.exe MTIR20283256_2101013335_20200507083759.PDF.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MTIR20283256_2101013335_20200507083759.PDF.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MTIR20283256_2101013335_20200507083759.PDF.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString MTIR20283256_2101013335_20200507083759.PDF.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
MTIR20283256_2101013335_20200507083759.PDF.exeMTIR20283256_2101013335_20200507083759.PDF.exepid process 1848 MTIR20283256_2101013335_20200507083759.PDF.exe 316 MTIR20283256_2101013335_20200507083759.PDF.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
MTIR20283256_2101013335_20200507083759.PDF.exedescription pid process Token: SeDebugPrivilege 1848 MTIR20283256_2101013335_20200507083759.PDF.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
MTIR20283256_2101013335_20200507083759.PDF.exedescription pid process target process PID 1848 wrote to memory of 1972 1848 MTIR20283256_2101013335_20200507083759.PDF.exe schtasks.exe PID 1848 wrote to memory of 1972 1848 MTIR20283256_2101013335_20200507083759.PDF.exe schtasks.exe PID 1848 wrote to memory of 1972 1848 MTIR20283256_2101013335_20200507083759.PDF.exe schtasks.exe PID 1848 wrote to memory of 1972 1848 MTIR20283256_2101013335_20200507083759.PDF.exe schtasks.exe PID 1848 wrote to memory of 316 1848 MTIR20283256_2101013335_20200507083759.PDF.exe MTIR20283256_2101013335_20200507083759.PDF.exe PID 1848 wrote to memory of 316 1848 MTIR20283256_2101013335_20200507083759.PDF.exe MTIR20283256_2101013335_20200507083759.PDF.exe PID 1848 wrote to memory of 316 1848 MTIR20283256_2101013335_20200507083759.PDF.exe MTIR20283256_2101013335_20200507083759.PDF.exe PID 1848 wrote to memory of 316 1848 MTIR20283256_2101013335_20200507083759.PDF.exe MTIR20283256_2101013335_20200507083759.PDF.exe PID 1848 wrote to memory of 316 1848 MTIR20283256_2101013335_20200507083759.PDF.exe MTIR20283256_2101013335_20200507083759.PDF.exe PID 1848 wrote to memory of 316 1848 MTIR20283256_2101013335_20200507083759.PDF.exe MTIR20283256_2101013335_20200507083759.PDF.exe PID 1848 wrote to memory of 316 1848 MTIR20283256_2101013335_20200507083759.PDF.exe MTIR20283256_2101013335_20200507083759.PDF.exe PID 1848 wrote to memory of 316 1848 MTIR20283256_2101013335_20200507083759.PDF.exe MTIR20283256_2101013335_20200507083759.PDF.exe PID 1848 wrote to memory of 316 1848 MTIR20283256_2101013335_20200507083759.PDF.exe MTIR20283256_2101013335_20200507083759.PDF.exe PID 1848 wrote to memory of 316 1848 MTIR20283256_2101013335_20200507083759.PDF.exe MTIR20283256_2101013335_20200507083759.PDF.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MTIR20283256_2101013335_20200507083759.PDF.exe"C:\Users\Admin\AppData\Local\Temp\MTIR20283256_2101013335_20200507083759.PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XeIkxtypDQCl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2185.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\MTIR20283256_2101013335_20200507083759.PDF.exe"{path}"2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp2185.tmpMD5
67c79577fe37c1367586ff75d0e3ffbc
SHA138cb01684cd7af74b496f75cca7aaeb94810ba09
SHA2561ba48bccdb27ffc42e297697bb7da485fb2abc411d098aea1041c6f3cd28c554
SHA5129dcb93721e393f3f0bf15f9cb7faaad1acb753a65e953099ffc945047fd03cec1729daa13e811c38a0d3f332e76b034c05fb6a66b4a31c05108faa619e2a8f66
-
memory/316-7-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/316-8-0x000000000041A1F8-mapping.dmp
-
memory/316-9-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/432-10-0x000007FEF6680000-0x000007FEF68FA000-memory.dmpFilesize
2.5MB
-
memory/1848-0-0x00000000742C0000-0x00000000749AE000-memory.dmpFilesize
6.9MB
-
memory/1848-1-0x0000000000BF0000-0x0000000000BF1000-memory.dmpFilesize
4KB
-
memory/1848-3-0x0000000000430000-0x0000000000433000-memory.dmpFilesize
12KB
-
memory/1848-4-0x0000000004630000-0x0000000004654000-memory.dmpFilesize
144KB
-
memory/1972-5-0x0000000000000000-mapping.dmp