Analysis

  • max time kernel
    59s
  • max time network
    62s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    05-03-2021 05:11

General

  • Target

    Video.nVidia.GeForce.8600.GTS.crack.exe

  • Size

    8.6MB

  • MD5

    4c5d5630a17759bff9cb25a75a6de902

  • SHA1

    7e30a081298ef34a5f7db00607f10c72464e4c96

  • SHA256

    45411d2b5bf4e2d0e75af577252aba0a84ccc51e7b05e9b67a54390bb7aab8d8

  • SHA512

    09d2a7fa28f88dd5c622b99318a7d68b1c3f9f6fa3edbe589cb067478dba73e790346b967599dde0745e8afeded0096c99d796206f691c34c903c97a01db80f3

Malware Config

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

  • Nirsoft 4 IoCs
  • Executes dropped EXE 20 IoCs
  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

  • Loads dropped DLL 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 2 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Runs ping.exe 1 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Video.nVidia.GeForce.8600.GTS.crack.exe
    "C:\Users\Admin\AppData\Local\Temp\Video.nVidia.GeForce.8600.GTS.crack.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:880
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3520
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
        keygen-pr.exe -p83fsase3Ge
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3084
        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2116
          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
            C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe -txt -scanlocal -file:potato.dat
            5⤵
            • Executes dropped EXE
            PID:3852
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
        keygen-step-1.exe
        3⤵
        • Executes dropped EXE
        PID:3316
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
        keygen-step-3.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2272
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:420
          • C:\Windows\SysWOW64\PING.EXE
            ping 1.1.1.1 -n 1 -w 3000
            5⤵
            • Runs ping.exe
            PID:3856
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
        keygen-step-4.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2104
        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"
          4⤵
          • Executes dropped EXE
          • Modifies data under HKEY_USERS
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:636
          • C:\Users\Admin\AppData\Roaming\F264.tmp.exe
            "C:\Users\Admin\AppData\Roaming\F264.tmp.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:3372
            • C:\Users\Admin\AppData\Roaming\F264.tmp.exe
              "C:\Users\Admin\AppData\Roaming\F264.tmp.exe"
              6⤵
              • Executes dropped EXE
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:4004
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:856
            • C:\Windows\SysWOW64\PING.EXE
              ping 127.0.0.1
              6⤵
              • Runs ping.exe
              PID:3580
        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"
          4⤵
          • Executes dropped EXE
          • Writes to the Master Boot Record (MBR)
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Modifies system certificate store
          • Suspicious use of SetWindowsHookEx
          PID:3172
          • C:\Windows\SysWOW64\msiexec.exe
            msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"
            5⤵
            • Enumerates connected drives
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            PID:2328
          • C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe
            C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe 0011 installp1
            5⤵
            • Executes dropped EXE
            • Writes to the Master Boot Record (MBR)
            • Suspicious use of SetThreadContext
            • Checks SCSI registry key(s)
            • Suspicious use of SetWindowsHookEx
            PID:744
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe"
              6⤵
              • Suspicious use of SetWindowsHookEx
              PID:3816
            • C:\Users\Admin\AppData\Roaming\1614924631923.exe
              "C:\Users\Admin\AppData\Roaming\1614924631923.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614924631923.txt"
              6⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              PID:4220
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe"
              6⤵
              • Suspicious use of SetWindowsHookEx
              PID:4752
            • C:\Users\Admin\AppData\Roaming\1614924636798.exe
              "C:\Users\Admin\AppData\Roaming\1614924636798.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614924636798.txt"
              6⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              PID:4764
          • C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe
            C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe 200 installp1
            5⤵
            • Executes dropped EXE
            • Writes to the Master Boot Record (MBR)
            • Checks SCSI registry key(s)
            • Suspicious use of SetWindowsHookEx
            PID:4072
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c taskkill /f /im chrome.exe
              6⤵
                PID:1380
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /f /im chrome.exe
                  7⤵
                  • Kills process with taskkill
                  PID:3568
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe"
                6⤵
                  PID:4328
                  • C:\Windows\SysWOW64\PING.EXE
                    ping 127.0.0.1 -n 3
                    7⤵
                    • Runs ping.exe
                    PID:4376
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"
                5⤵
                  PID:1856
                  • C:\Windows\SysWOW64\PING.EXE
                    ping 127.0.0.1 -n 3
                    6⤵
                    • Runs ping.exe
                    PID:3464
              • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe
                "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe"
                4⤵
                • Executes dropped EXE
                PID:1724
                • C:\Users\Admin\AppData\Local\Temp\W4O481FE7O\multitimer.exe
                  "C:\Users\Admin\AppData\Local\Temp\W4O481FE7O\multitimer.exe" 0 3060197d33d91c80.94013368 0 101
                  5⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  PID:1772
                  • C:\Users\Admin\AppData\Local\Temp\W4O481FE7O\multitimer.exe
                    "C:\Users\Admin\AppData\Local\Temp\W4O481FE7O\multitimer.exe" 1 3.1614921253.6041be254aaae 101
                    6⤵
                    • Executes dropped EXE
                    PID:4976
                    • C:\Users\Admin\AppData\Local\Temp\W4O481FE7O\multitimer.exe
                      "C:\Users\Admin\AppData\Local\Temp\W4O481FE7O\multitimer.exe" 2 3.1614921253.6041be254aaae
                      7⤵
                        PID:5084
                • C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe
                  "C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"
                  4⤵
                  • Executes dropped EXE
                  PID:4032
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /c taskkill /f /im chrome.exe
                    5⤵
                      PID:2300
                      • C:\Windows\SysWOW64\taskkill.exe
                        taskkill /f /im chrome.exe
                        6⤵
                        • Kills process with taskkill
                        PID:4144
                  • C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe
                    "C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"
                    4⤵
                    • Executes dropped EXE
                    • Checks whether UAC is enabled
                    PID:4404
                  • C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe
                    "C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"
                    4⤵
                    • Executes dropped EXE
                    PID:4908
                    • C:\ProgramData\3933505.43
                      "C:\ProgramData\3933505.43"
                      5⤵
                        PID:2796
                      • C:\ProgramData\1176841.12
                        "C:\ProgramData\1176841.12"
                        5⤵
                          PID:4168
                • C:\Windows\system32\msiexec.exe
                  C:\Windows\system32\msiexec.exe /V
                  1⤵
                  • Enumerates connected drives
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3828
                  • C:\Windows\syswow64\MsiExec.exe
                    C:\Windows\syswow64\MsiExec.exe -Embedding 63A366DA7638C1295CF9F9F4F330009D C
                    2⤵
                    • Loads dropped DLL
                    PID:2572

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • memory/636-31-0x00000000007D0000-0x00000000007DD000-memory.dmp

                  Filesize

                  52KB

                • memory/636-48-0x0000000003680000-0x0000000003752000-memory.dmp

                  Filesize

                  840KB

                • memory/744-85-0x00000000725A0000-0x0000000072633000-memory.dmp

                  Filesize

                  588KB

                • memory/744-100-0x0000000002D60000-0x000000000320F000-memory.dmp

                  Filesize

                  4.7MB

                • memory/1724-95-0x0000000000890000-0x0000000000891000-memory.dmp

                  Filesize

                  4KB

                • memory/1724-97-0x000000001B550000-0x000000001B552000-memory.dmp

                  Filesize

                  8KB

                • memory/1724-92-0x00007FF943990000-0x00007FF94437C000-memory.dmp

                  Filesize

                  9.9MB

                • memory/1772-108-0x00007FF9439E0000-0x00007FF944380000-memory.dmp

                  Filesize

                  9.6MB

                • memory/1772-119-0x0000000002DA0000-0x0000000002DA2000-memory.dmp

                  Filesize

                  8KB

                • memory/2116-53-0x0000000000560000-0x0000000000561000-memory.dmp

                  Filesize

                  4KB

                • memory/2116-54-0x0000000000550000-0x000000000056B000-memory.dmp

                  Filesize

                  108KB

                • memory/2116-52-0x0000000002EC0000-0x0000000002FAF000-memory.dmp

                  Filesize

                  956KB

                • memory/2116-26-0x0000000002540000-0x00000000026DC000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3172-62-0x00000000725A0000-0x0000000072633000-memory.dmp

                  Filesize

                  588KB

                • memory/3172-63-0x0000000010000000-0x000000001033E000-memory.dmp

                  Filesize

                  3.2MB

                • memory/3372-44-0x0000000003100000-0x0000000003101000-memory.dmp

                  Filesize

                  4KB

                • memory/3372-49-0x0000000002E20000-0x0000000002E65000-memory.dmp

                  Filesize

                  276KB

                • memory/3816-111-0x00007FF95ABF0000-0x00007FF95AC6E000-memory.dmp

                  Filesize

                  504KB

                • memory/3816-121-0x0000000010000000-0x0000000010057000-memory.dmp

                  Filesize

                  348KB

                • memory/3816-122-0x00000287B8680000-0x00000287B8681000-memory.dmp

                  Filesize

                  4KB

                • memory/3852-28-0x0000000000400000-0x0000000000983000-memory.dmp

                  Filesize

                  5.5MB

                • memory/3852-40-0x0000000000400000-0x0000000000983000-memory.dmp

                  Filesize

                  5.5MB

                • memory/4004-45-0x0000000000400000-0x0000000000449000-memory.dmp

                  Filesize

                  292KB

                • memory/4004-50-0x0000000000400000-0x0000000000449000-memory.dmp

                  Filesize

                  292KB

                • memory/4072-87-0x00000000725A0000-0x0000000072633000-memory.dmp

                  Filesize

                  588KB

                • memory/4072-99-0x0000000002D30000-0x00000000031DF000-memory.dmp

                  Filesize

                  4.7MB

                • memory/4220-127-0x00000000725A0000-0x0000000072633000-memory.dmp

                  Filesize

                  588KB

                • memory/4752-145-0x000001E9EBC40000-0x000001E9EBC41000-memory.dmp

                  Filesize

                  4KB

                • memory/4752-135-0x00007FF95ABF0000-0x00007FF95AC6E000-memory.dmp

                  Filesize

                  504KB

                • memory/4764-139-0x00000000725A0000-0x0000000072633000-memory.dmp

                  Filesize

                  588KB

                • memory/4908-165-0x000000001C5E0000-0x000000001C5E2000-memory.dmp

                  Filesize

                  8KB

                • memory/4908-151-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

                  Filesize

                  4KB

                • memory/4908-144-0x00007FF9416D0000-0x00007FF9420BC000-memory.dmp

                  Filesize

                  9.9MB

                • memory/4908-149-0x0000000000B80000-0x0000000000BB3000-memory.dmp

                  Filesize

                  204KB

                • memory/4908-148-0x0000000000870000-0x0000000000871000-memory.dmp

                  Filesize

                  4KB

                • memory/4908-146-0x0000000000340000-0x0000000000341000-memory.dmp

                  Filesize

                  4KB

                • memory/4976-153-0x00007FF9439E0000-0x00007FF944380000-memory.dmp

                  Filesize

                  9.6MB

                • memory/4976-161-0x0000000001430000-0x0000000001432000-memory.dmp

                  Filesize

                  8KB

                • memory/5084-159-0x00007FF9439E0000-0x00007FF944380000-memory.dmp

                  Filesize

                  9.6MB

                • memory/5084-166-0x0000000003130000-0x0000000003132000-memory.dmp

                  Filesize

                  8KB