Analysis
-
max time kernel
61s -
max time network
121s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 19:39
General
-
Target
MTIR20283256_2101013335_20200507083759.PDF.exe
-
Size
406KB
-
MD5
6c378a9a4067f1affdb254dfa96943da
-
SHA1
12911df0be6ae9f4292038e60c5aad41073c55fd
-
SHA256
fd975fd3af1f754bf7b03eca4ae29e3054f34f7176b26c2578efddde76947f70
-
SHA512
33dc7b3b743bc77efea699a3508b4fbe1f0707cd6ad38f9cba8a1257b4c881d5cf6212d3c3a8cf1e3efe46dadff55747b1dee0b6df8942e268891e2a3d8f3858
Malware Config
Extracted
azorult
http://ensaenerji.com/mep/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
CoreEntity .NET Packer 1 IoCs
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
-
rezer0 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
-
Suspicious use of SetThreadContext 1 IoCs
-
Program crash 1 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MTIR20283256_2101013335_20200507083759.PDF.exe"C:\Users\Admin\AppData\Local\Temp\MTIR20283256_2101013335_20200507083759.PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XeIkxtypDQCl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3CEF.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\MTIR20283256_2101013335_20200507083759.PDF.exe"{path}"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 11963⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3CEF.tmpMD5
92bc2d7b231dd192b858d4a4f162d221
SHA19f9832ea167ab62c0b91f4e443a89b0cb58bd2c3
SHA256048ecfd079114ca4cad7ffd5da949e74d0ed2bd265c4d5308e35cd88c86140d3
SHA5127088f2c7defddfb3c1673c46c20cce26019e47a33dc6cd1c181abcb48cce1a374415e39b356f2d0a2d71de5d34d4f0af61e20a66ed19d68bec6afb04f89b28b1
-
memory/1144-9-0x0000000000000000-mapping.dmp
-
memory/2136-24-0x0000000004DA0000-0x0000000004DA1000-memory.dmpFilesize
4KB
-
memory/2136-14-0x0000000004870000-0x0000000004871000-memory.dmpFilesize
4KB
-
memory/2412-18-0x000000000041A1F8-mapping.dmp
-
memory/2412-17-0x000000000041A1F8-mapping.dmp
-
memory/2412-22-0x000000000041A1F8-mapping.dmp
-
memory/2412-23-0x000000000041A1F8-mapping.dmp
-
memory/2412-21-0x000000000041A1F8-mapping.dmp
-
memory/2412-20-0x000000000041A1F8-mapping.dmp
-
memory/2412-11-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2412-12-0x000000000041A1F8-mapping.dmp
-
memory/2412-13-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2412-19-0x000000000041A1F8-mapping.dmp
-
memory/2412-15-0x000000000041A1F8-mapping.dmp
-
memory/2412-16-0x000000000041A1F8-mapping.dmp
-
memory/3976-4-0x0000000004FD0000-0x0000000004FD1000-memory.dmpFilesize
4KB
-
memory/3976-3-0x0000000005610000-0x0000000005611000-memory.dmpFilesize
4KB
-
memory/3976-0-0x0000000073920000-0x000000007400E000-memory.dmpFilesize
6.9MB
-
memory/3976-6-0x00000000050F0000-0x00000000050F3000-memory.dmpFilesize
12KB
-
memory/3976-5-0x0000000004F80000-0x0000000004F81000-memory.dmpFilesize
4KB
-
memory/3976-8-0x0000000006D10000-0x0000000006D11000-memory.dmpFilesize
4KB
-
memory/3976-7-0x0000000006C40000-0x0000000006C64000-memory.dmpFilesize
144KB
-
memory/3976-1-0x00000000006E0000-0x00000000006E1000-memory.dmpFilesize
4KB