Analysis
-
max time kernel
1723s -
max time network
1725s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
28/02/2021, 20:44
Static task
static1
Behavioral task
behavioral1
Sample
[CRACKHEAP.NET]PW12345NewLive_All_Media_Fixer_Pro_v6_keygen_by_FUTURiTY.exe
Resource
win10v20201028
azorultgluptebametasploitredlinesmokeloadervidarxmrigagilenetbackdoorbootkitdiscoverydropperevasioninfostealerloadermacrominerpersistencespywarestealertrojanupxxlm
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
[CRACKHEAP.NET]PW12345NewLive_All_Media_Fixer_Pro_v6_keygen_by_FUTURiTY.exe
Resource
win10v20201028
azorultdiamondfoxgluptebametasploitraccoonredlinesmokeloadertofseevidarxmrig9ba64f4b6fe448911470a88f09d6e7d5b92ff0abagilenetbackdoorbootkitbotnetdiscoverydropperevasioninfostealerloadermacrominerpersistencespywarestealertrojanupxxlm
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
[CRACKHEAP.NET]PW12345NewLive_All_Media_Fixer_Pro_v6_keygen_by_FUTURiTY.exe
Resource
win10v20201028
azorultdiamondfoxgluptebametasploitraccoonredlinesmokeloadervidarxmrig9ba64f4b6fe448911470a88f09d6e7d5b92ff0abagilenetbackdoorbootkitbotnetdiscoverydropperevasioninfostealerloadermacrominerpersistencespywarestealertrojanupxxlm
windows10_x64
0 signatures
0 seconds
General
-
Target
[CRACKHEAP.NET]PW12345NewLive_All_Media_Fixer_Pro_v6_keygen_by_FUTURiTY.exe
-
Size
9.2MB
-
MD5
ad902aa32e3899e0800521f9a32f988c
-
SHA1
4f1a7ac4ce37f8fcf31802f73193d3e9a706115a
-
SHA256
cbdca73f35a74084333ad849b15742bed455e5bfd4ce24edb202e71586c4d77f
-
SHA512
631c091108d386b35d50464846fbeae2eff44480d3903866d15ac1ac61ae27eecf2361ac60a7539ca034daec8a63e161ffd66488fdae653546baf0407e11ca43
Malware Config
Extracted
Family
azorult
C2
http://kvaka.li/1210776429.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Executes dropped EXE 6 IoCs
pid Process 848 keygen-pr.exe 336 keygen-step-1.exe 368 keygen-step-3.exe 1724 keygen-step-4.exe 1644 key.exe 1128 key.exe -
Loads dropped DLL 10 IoCs
pid Process 1232 cmd.exe 1232 cmd.exe 1232 cmd.exe 1232 cmd.exe 1232 cmd.exe 848 keygen-pr.exe 848 keygen-pr.exe 848 keygen-pr.exe 848 keygen-pr.exe 1644 key.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1644 set thread context of 1128 1644 key.exe 36 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 112 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1644 key.exe 1644 key.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeImpersonatePrivilege 1644 key.exe Token: SeTcbPrivilege 1644 key.exe Token: SeChangeNotifyPrivilege 1644 key.exe Token: SeCreateTokenPrivilege 1644 key.exe Token: SeBackupPrivilege 1644 key.exe Token: SeRestorePrivilege 1644 key.exe Token: SeIncreaseQuotaPrivilege 1644 key.exe Token: SeAssignPrimaryTokenPrivilege 1644 key.exe Token: SeImpersonatePrivilege 1644 key.exe Token: SeTcbPrivilege 1644 key.exe Token: SeChangeNotifyPrivilege 1644 key.exe Token: SeCreateTokenPrivilege 1644 key.exe Token: SeBackupPrivilege 1644 key.exe Token: SeRestorePrivilege 1644 key.exe Token: SeIncreaseQuotaPrivilege 1644 key.exe Token: SeAssignPrimaryTokenPrivilege 1644 key.exe Token: SeImpersonatePrivilege 1644 key.exe Token: SeTcbPrivilege 1644 key.exe Token: SeChangeNotifyPrivilege 1644 key.exe Token: SeCreateTokenPrivilege 1644 key.exe Token: SeBackupPrivilege 1644 key.exe Token: SeRestorePrivilege 1644 key.exe Token: SeIncreaseQuotaPrivilege 1644 key.exe Token: SeAssignPrimaryTokenPrivilege 1644 key.exe Token: SeImpersonatePrivilege 1644 key.exe Token: SeTcbPrivilege 1644 key.exe Token: SeChangeNotifyPrivilege 1644 key.exe Token: SeCreateTokenPrivilege 1644 key.exe Token: SeBackupPrivilege 1644 key.exe Token: SeRestorePrivilege 1644 key.exe Token: SeIncreaseQuotaPrivilege 1644 key.exe Token: SeAssignPrimaryTokenPrivilege 1644 key.exe -
Suspicious use of WriteProcessMemory 55 IoCs
description pid Process procid_target PID 892 wrote to memory of 1232 892 [CRACKHEAP.NET]PW12345NewLive_All_Media_Fixer_Pro_v6_keygen_by_FUTURiTY.exe 29 PID 892 wrote to memory of 1232 892 [CRACKHEAP.NET]PW12345NewLive_All_Media_Fixer_Pro_v6_keygen_by_FUTURiTY.exe 29 PID 892 wrote to memory of 1232 892 [CRACKHEAP.NET]PW12345NewLive_All_Media_Fixer_Pro_v6_keygen_by_FUTURiTY.exe 29 PID 892 wrote to memory of 1232 892 [CRACKHEAP.NET]PW12345NewLive_All_Media_Fixer_Pro_v6_keygen_by_FUTURiTY.exe 29 PID 1232 wrote to memory of 848 1232 cmd.exe 31 PID 1232 wrote to memory of 848 1232 cmd.exe 31 PID 1232 wrote to memory of 848 1232 cmd.exe 31 PID 1232 wrote to memory of 848 1232 cmd.exe 31 PID 1232 wrote to memory of 848 1232 cmd.exe 31 PID 1232 wrote to memory of 848 1232 cmd.exe 31 PID 1232 wrote to memory of 848 1232 cmd.exe 31 PID 1232 wrote to memory of 336 1232 cmd.exe 32 PID 1232 wrote to memory of 336 1232 cmd.exe 32 PID 1232 wrote to memory of 336 1232 cmd.exe 32 PID 1232 wrote to memory of 336 1232 cmd.exe 32 PID 1232 wrote to memory of 368 1232 cmd.exe 33 PID 1232 wrote to memory of 368 1232 cmd.exe 33 PID 1232 wrote to memory of 368 1232 cmd.exe 33 PID 1232 wrote to memory of 368 1232 cmd.exe 33 PID 1232 wrote to memory of 1724 1232 cmd.exe 34 PID 1232 wrote to memory of 1724 1232 cmd.exe 34 PID 1232 wrote to memory of 1724 1232 cmd.exe 34 PID 1232 wrote to memory of 1724 1232 cmd.exe 34 PID 848 wrote to memory of 1644 848 keygen-pr.exe 35 PID 848 wrote to memory of 1644 848 keygen-pr.exe 35 PID 848 wrote to memory of 1644 848 keygen-pr.exe 35 PID 848 wrote to memory of 1644 848 keygen-pr.exe 35 PID 848 wrote to memory of 1644 848 keygen-pr.exe 35 PID 848 wrote to memory of 1644 848 keygen-pr.exe 35 PID 848 wrote to memory of 1644 848 keygen-pr.exe 35 PID 1644 wrote to memory of 1128 1644 key.exe 36 PID 1644 wrote to memory of 1128 1644 key.exe 36 PID 1644 wrote to memory of 1128 1644 key.exe 36 PID 1644 wrote to memory of 1128 1644 key.exe 36 PID 1644 wrote to memory of 1128 1644 key.exe 36 PID 1644 wrote to memory of 1128 1644 key.exe 36 PID 1644 wrote to memory of 1128 1644 key.exe 36 PID 1644 wrote to memory of 1128 1644 key.exe 36 PID 1644 wrote to memory of 1128 1644 key.exe 36 PID 1644 wrote to memory of 1128 1644 key.exe 36 PID 1644 wrote to memory of 1128 1644 key.exe 36 PID 1644 wrote to memory of 1128 1644 key.exe 36 PID 1644 wrote to memory of 1128 1644 key.exe 36 PID 1644 wrote to memory of 1128 1644 key.exe 36 PID 1644 wrote to memory of 1128 1644 key.exe 36 PID 1644 wrote to memory of 1128 1644 key.exe 36 PID 1644 wrote to memory of 1128 1644 key.exe 36 PID 368 wrote to memory of 992 368 keygen-step-3.exe 39 PID 368 wrote to memory of 992 368 keygen-step-3.exe 39 PID 368 wrote to memory of 992 368 keygen-step-3.exe 39 PID 368 wrote to memory of 992 368 keygen-step-3.exe 39 PID 992 wrote to memory of 112 992 cmd.exe 41 PID 992 wrote to memory of 112 992 cmd.exe 41 PID 992 wrote to memory of 112 992 cmd.exe 41 PID 992 wrote to memory of 112 992 cmd.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345NewLive_All_Media_Fixer_Pro_v6_keygen_by_FUTURiTY.exe"C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345NewLive_All_Media_Fixer_Pro_v6_keygen_by_FUTURiTY.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat5⤵
- Executes dropped EXE
PID:1128
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
PID:336
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
PID:112
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
PID:1724
-
-