Resubmissions
06/04/2021, 13:50
210406-gc51ndzsc2 1026/03/2021, 23:40
210326-d1ybrjhevx 1013/03/2021, 17:16
210313-8s7b52z63e 1005/03/2021, 14:52
210305-34k3zj54f2 1001/03/2021, 13:17
210301-naamxpgf4e 1028/02/2021, 20:46
210228-6q3b959xae 1028/02/2021, 20:15
210228-mbr268za12 1028/02/2021, 18:32
210228-h944b5cpxa 1028/02/2021, 15:10
210228-hnwwpyjy7j 10Analysis
-
max time kernel
1578s -
max time network
1580s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
01/03/2021, 13:17
Static task
static1
Behavioral task
behavioral1
Sample
[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
Resource
win10v20201028
azorultgluptebametasploitredlinevidarxmrigagilenetbackdoorbootkitdiscoverydropperevasioninfostealerloadermacrominerpersistencespywarestealertrojanupxxlm
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
Resource
win10v20201028
azorultgluptebametasploitplugxredlinevidarxmrigagilenetbackdoorbootkitdiscoverydropperevasioninfostealerloadermacrominerpersistencespywarestealertrojanupxxlm
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
Resource
win10v20201028
azorultgluptebametasploitplugxponyredlinevidarxmrigagilenetbackdoorbootkitdiscoverydropperevasioninfostealerloadermacrominerpersistenceratspywarestealertrojanupxxlm
windows10_x64
0 signatures
0 seconds
General
-
Target
[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
-
Size
9.2MB
-
MD5
b806267b5f3b7760df56396b1cf05e6d
-
SHA1
5166d4c1d3e476281d9e991eababc3e4aa9ec5ad
-
SHA256
f95d12a0dbd8199d16f48d8e4cbe69a8d4ec16c534efb36e52a662664e1c1783
-
SHA512
30e393bb3898edc8ab5fb04e62ce421ddf3903075f59e3880408b300f46bb74a85088336d6e1203b2101152cebeef4c1730290b41ca77604ecb722c8f627328b
Malware Config
Extracted
Family
azorult
C2
http://kvaka.li/1210776429.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Executes dropped EXE 6 IoCs
pid Process 736 keygen-pr.exe 1492 keygen-step-1.exe 1764 keygen-step-3.exe 1672 keygen-step-4.exe 940 key.exe 608 key.exe -
Loads dropped DLL 10 IoCs
pid Process 1716 cmd.exe 1716 cmd.exe 1716 cmd.exe 1716 cmd.exe 1716 cmd.exe 736 keygen-pr.exe 736 keygen-pr.exe 736 keygen-pr.exe 736 keygen-pr.exe 940 key.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 940 set thread context of 608 940 key.exe 36 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1520 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 940 key.exe 940 key.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeImpersonatePrivilege 940 key.exe Token: SeTcbPrivilege 940 key.exe Token: SeChangeNotifyPrivilege 940 key.exe Token: SeCreateTokenPrivilege 940 key.exe Token: SeBackupPrivilege 940 key.exe Token: SeRestorePrivilege 940 key.exe Token: SeIncreaseQuotaPrivilege 940 key.exe Token: SeAssignPrimaryTokenPrivilege 940 key.exe Token: SeImpersonatePrivilege 940 key.exe Token: SeTcbPrivilege 940 key.exe Token: SeChangeNotifyPrivilege 940 key.exe Token: SeCreateTokenPrivilege 940 key.exe Token: SeBackupPrivilege 940 key.exe Token: SeRestorePrivilege 940 key.exe Token: SeIncreaseQuotaPrivilege 940 key.exe Token: SeAssignPrimaryTokenPrivilege 940 key.exe Token: SeImpersonatePrivilege 940 key.exe Token: SeTcbPrivilege 940 key.exe Token: SeChangeNotifyPrivilege 940 key.exe Token: SeCreateTokenPrivilege 940 key.exe Token: SeBackupPrivilege 940 key.exe Token: SeRestorePrivilege 940 key.exe Token: SeIncreaseQuotaPrivilege 940 key.exe Token: SeAssignPrimaryTokenPrivilege 940 key.exe Token: SeImpersonatePrivilege 940 key.exe Token: SeTcbPrivilege 940 key.exe Token: SeChangeNotifyPrivilege 940 key.exe Token: SeCreateTokenPrivilege 940 key.exe Token: SeBackupPrivilege 940 key.exe Token: SeRestorePrivilege 940 key.exe Token: SeIncreaseQuotaPrivilege 940 key.exe Token: SeAssignPrimaryTokenPrivilege 940 key.exe -
Suspicious use of WriteProcessMemory 55 IoCs
description pid Process procid_target PID 1832 wrote to memory of 1716 1832 [CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe 29 PID 1832 wrote to memory of 1716 1832 [CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe 29 PID 1832 wrote to memory of 1716 1832 [CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe 29 PID 1832 wrote to memory of 1716 1832 [CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe 29 PID 1716 wrote to memory of 736 1716 cmd.exe 31 PID 1716 wrote to memory of 736 1716 cmd.exe 31 PID 1716 wrote to memory of 736 1716 cmd.exe 31 PID 1716 wrote to memory of 736 1716 cmd.exe 31 PID 1716 wrote to memory of 736 1716 cmd.exe 31 PID 1716 wrote to memory of 736 1716 cmd.exe 31 PID 1716 wrote to memory of 736 1716 cmd.exe 31 PID 1716 wrote to memory of 1492 1716 cmd.exe 32 PID 1716 wrote to memory of 1492 1716 cmd.exe 32 PID 1716 wrote to memory of 1492 1716 cmd.exe 32 PID 1716 wrote to memory of 1492 1716 cmd.exe 32 PID 1716 wrote to memory of 1764 1716 cmd.exe 33 PID 1716 wrote to memory of 1764 1716 cmd.exe 33 PID 1716 wrote to memory of 1764 1716 cmd.exe 33 PID 1716 wrote to memory of 1764 1716 cmd.exe 33 PID 1716 wrote to memory of 1672 1716 cmd.exe 34 PID 1716 wrote to memory of 1672 1716 cmd.exe 34 PID 1716 wrote to memory of 1672 1716 cmd.exe 34 PID 1716 wrote to memory of 1672 1716 cmd.exe 34 PID 736 wrote to memory of 940 736 keygen-pr.exe 35 PID 736 wrote to memory of 940 736 keygen-pr.exe 35 PID 736 wrote to memory of 940 736 keygen-pr.exe 35 PID 736 wrote to memory of 940 736 keygen-pr.exe 35 PID 736 wrote to memory of 940 736 keygen-pr.exe 35 PID 736 wrote to memory of 940 736 keygen-pr.exe 35 PID 736 wrote to memory of 940 736 keygen-pr.exe 35 PID 940 wrote to memory of 608 940 key.exe 36 PID 940 wrote to memory of 608 940 key.exe 36 PID 940 wrote to memory of 608 940 key.exe 36 PID 940 wrote to memory of 608 940 key.exe 36 PID 940 wrote to memory of 608 940 key.exe 36 PID 940 wrote to memory of 608 940 key.exe 36 PID 940 wrote to memory of 608 940 key.exe 36 PID 940 wrote to memory of 608 940 key.exe 36 PID 940 wrote to memory of 608 940 key.exe 36 PID 940 wrote to memory of 608 940 key.exe 36 PID 940 wrote to memory of 608 940 key.exe 36 PID 940 wrote to memory of 608 940 key.exe 36 PID 940 wrote to memory of 608 940 key.exe 36 PID 940 wrote to memory of 608 940 key.exe 36 PID 940 wrote to memory of 608 940 key.exe 36 PID 940 wrote to memory of 608 940 key.exe 36 PID 940 wrote to memory of 608 940 key.exe 36 PID 1764 wrote to memory of 780 1764 keygen-step-3.exe 39 PID 1764 wrote to memory of 780 1764 keygen-step-3.exe 39 PID 1764 wrote to memory of 780 1764 keygen-step-3.exe 39 PID 1764 wrote to memory of 780 1764 keygen-step-3.exe 39 PID 780 wrote to memory of 1520 780 cmd.exe 41 PID 780 wrote to memory of 1520 780 cmd.exe 41 PID 780 wrote to memory of 1520 780 cmd.exe 41 PID 780 wrote to memory of 1520 780 cmd.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe"C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat5⤵
- Executes dropped EXE
PID:608
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
PID:1492
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
PID:1520
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
PID:1672
-
-