Analysis
- max time kernel
5s - max time network
151s - platform
windows10_x64 - resource
win10v20201028 - submitted
17/11/2020, 12:07
General
- Target 1aa07bca0de6bcdaff093b47218c9c9c.exe
- Size 2.0MB
- Sample201117-cjsp2bsqgn
- SHA256 6175df01c768533f5c4e3e3d1a49d0770a2dcca9c45ae2d150d95f4ff666b54f
Malware Config
Extracted
-
azorult
-
http://0x21.in:8000/_az/
Signatures
- Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
- Quasar RAT
Quasar is an open source Remote Access Tool.
- ServiceHost packer 34 IoCs
Detects ServiceHost packer used for .NET malware
- Executes dropped EXE 2 IoCs
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext 2 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1aa07bca0de6bcdaff093b47218c9c9c.exe"C:\Users\Admin\AppData\Local\Temp\1aa07bca0de6bcdaff093b47218c9c9c.exe"1⤵
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵
- Maps connected drives based on registry
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\1aa07bca0de6bcdaff093b47218c9c9c.exe"C:\Users\Admin\AppData\Local\Temp\1aa07bca0de6bcdaff093b47218c9c9c.exe"2⤵
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/648-11-0x0000000005720000-0x0000000005721000-memory.dmp
memory/648-17-0x0000000005290000-0x0000000005291000-memory.dmp
memory/648-18-0x0000000005FE0000-0x0000000005FE1000-memory.dmp
memory/648-19-0x00000000063B0000-0x00000000063B1000-memory.dmp
memory/648-14-0x0000000005320000-0x0000000005321000-memory.dmp
memory/648-9-0x00000000009B0000-0x00000000009B1000-memory.dmp
memory/648-7-0x00000000722C0000-0x00000000729AE000-memory.dmp
memory/936-12-0x0000000000370000-0x0000000000390000-memory.dmp
memory/1000-49-0x0000000002600000-0x000000000269C000-memory.dmp
memory/1740-24-0x00000000722C0000-0x00000000729AE000-memory.dmp
memory/1740-33-0x0000000006890000-0x0000000006891000-memory.dmp
memory/2080-158-0x00000000722C0000-0x00000000729AE000-memory.dmp
memory/2228-59-0x00000000046F0000-0x00000000046F1000-memory.dmp
memory/2228-117-0x00000000057D0000-0x00000000057D1000-memory.dmp
memory/2444-50-0x00000000001B0000-0x00000000001D0000-memory.dmp
memory/2700-15-0x00000000031B0000-0x000000000324C000-memory.dmp
memory/3148-43-0x00000000722C0000-0x00000000729AE000-memory.dmp