Analysis
- max time kernel
7s - max time network
151s - platform
windows10_x64 - resource
win10v20201028 - submitted
13/11/2020, 15:59
General
- Target 381c28bd8d6e3538bcdea645faa825012355305a2ea5df8ad4f526b3750484e5.exe
- Size 2.0MB
- Sample201113-s983d73bdn
- SHA256 381c28bd8d6e3538bcdea645faa825012355305a2ea5df8ad4f526b3750484e5
Malware Config
Extracted
-
azorult
-
http://0x21.in:8000/_az/
Signatures
- Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
- ServiceHost packer 36 IoCs
Detects ServiceHost packer used for .NET malware
- Executes dropped EXE 2 IoCs
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext 2 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\381c28bd8d6e3538bcdea645faa825012355305a2ea5df8ad4f526b3750484e5.exe"C:\Users\Admin\AppData\Local\Temp\381c28bd8d6e3538bcdea645faa825012355305a2ea5df8ad4f526b3750484e5.exe"1⤵
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵
- Maps connected drives based on registry
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\381c28bd8d6e3538bcdea645faa825012355305a2ea5df8ad4f526b3750484e5.exe"C:\Users\Admin\AppData\Local\Temp\381c28bd8d6e3538bcdea645faa825012355305a2ea5df8ad4f526b3750484e5.exe"2⤵
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/936-74-0x00000000056D0000-0x00000000056D1000-memory.dmp
memory/936-56-0x0000000004FF0000-0x0000000004FF1000-memory.dmp
memory/936-38-0x0000000004630000-0x0000000004631000-memory.dmp
memory/1308-96-0x0000000072390000-0x0000000072A7E000-memory.dmp
memory/1460-24-0x0000000072390000-0x0000000072A7E000-memory.dmp
memory/1460-33-0x00000000060A0000-0x00000000060A1000-memory.dmp
memory/1528-79-0x0000000072390000-0x0000000072A7E000-memory.dmp
memory/1848-101-0x0000000000400000-0x0000000000420000-memory.dmp
memory/2660-12-0x0000000002CC0000-0x0000000002D5C000-memory.dmp
memory/2748-93-0x0000000000FC0000-0x000000000105C000-memory.dmp
memory/3096-16-0x0000000005310000-0x0000000005311000-memory.dmp
memory/3096-11-0x0000000072390000-0x0000000072A7E000-memory.dmp
memory/3096-15-0x0000000005770000-0x0000000005771000-memory.dmp
memory/3096-17-0x00000000054B0000-0x00000000054B1000-memory.dmp
memory/3096-13-0x00000000009D0000-0x00000000009D1000-memory.dmp
memory/3096-19-0x00000000063E0000-0x00000000063E1000-memory.dmp
memory/3096-18-0x0000000005FF0000-0x0000000005FF1000-memory.dmp
memory/3788-5-0x0000000000880000-0x00000000008A0000-memory.dmp