Overview

overview

10

Static

static

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ฺฺ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows7_x64

10

Analysis

  • max time kernel
    486s
  • max time network
    380s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    26-03-2021 23:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Windows_10_pro_100_original_keygen_by_KeygenNinja.exe

  • Size

    10.8MB

  • MD5

    5763266004cd5549b61466c8b10c6535

  • SHA1

    4d7fe3d2a06cd11797f66a67efaae78a1585bcee

  • SHA256

    f2ed9574498ab5a4d15fa0f49ba9d64491fc22037a33b5076b2509083a408176

  • SHA512

    c48c1d9741cec9a38f9797e22e56ac264ae675d957c5f44340b1fab6107d1e63de0515b011add4e843a0bd470bf3749a582e44f70542be0d01ded2a20b499e39

Score
10/10
azorultplugxponybootkitdiscoveryevasioninfostealermacropersistenceratspywarestealertrojanupxxlm

Malware Config

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    trojanplugx
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Nirsoft 6 IoCs
  • Executes dropped EXE 25 IoCs
  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

    macroxlm
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 4 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 7 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Windows_10_pro_100_original_keygen_by_KeygenNinja.exe
    "C:\Users\Admin\AppData\Local\Temp\Windows_10_pro_100_original_keygen_by_KeygenNinja.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3920
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1136
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\intro.exe
        intro.exe 1O5ZF
        3⤵
        • Executes dropped EXE
        PID:2588
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
        keygen-pr.exe -p83fsase3Ge
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3748
        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2376
          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
            C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
            5⤵
            • Executes dropped EXE
            PID:3512
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
        keygen-step-1.exe
        3⤵
        • Executes dropped EXE
        PID:2896
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
        keygen-step-3.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1132
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1252
          • C:\Windows\SysWOW64\PING.EXE
            ping 1.1.1.1 -n 1 -w 3000
            5⤵
            • Runs ping.exe
            PID:1604
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
        keygen-step-4.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:2448
        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\002.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX2\002.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2200
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c cd %cd% && rar.exe -y x -p123 *.rar && C:\Users\Admin\AppData\Local\Temp\\002.exe
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2900
            • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Rar.exe
              rar.exe -y x -p123 *.rar
              6⤵
              • Executes dropped EXE
              PID:1356
        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2132
          • C:\Users\Admin\AppData\Local\Temp\sib5E35.tmp\0\setup.exe
            "C:\Users\Admin\AppData\Local\Temp\sib5E35.tmp\0\setup.exe" -s
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4092
            • C:\Program Files (x86)\ujvqkl7ofji6\aliens.exe
              "C:\Program Files (x86)\ujvqkl7ofji6\aliens.exe"
              6⤵
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Writes to the Master Boot Record (MBR)
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Modifies system certificate store
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3828
              • C:\Windows\SysWOW64\msiexec.exe
                msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"
                7⤵
                • Enumerates connected drives
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                PID:2168
              • C:\Users\Admin\AppData\Local\Temp\85F91A36E275562F.exe
                C:\Users\Admin\AppData\Local\Temp\85F91A36E275562F.exe 0011 installp1
                7⤵
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Writes to the Master Boot Record (MBR)
                • Suspicious use of SetThreadContext
                • Checks SCSI registry key(s)
                • Suspicious use of SetWindowsHookEx
                PID:2612
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe"
                  8⤵
                  • Suspicious use of SetWindowsHookEx
                  PID:1428
                • C:\Users\Admin\AppData\Roaming\1616801538460.exe
                  "C:\Users\Admin\AppData\Roaming\1616801538460.exe" /sjson "C:\Users\Admin\AppData\Roaming\1616801538460.txt"
                  8⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  PID:4324
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe"
                  8⤵
                  • Suspicious use of SetWindowsHookEx
                  PID:4528
                • C:\Users\Admin\AppData\Roaming\1616801539960.exe
                  "C:\Users\Admin\AppData\Roaming\1616801539960.exe" /sjson "C:\Users\Admin\AppData\Roaming\1616801539960.txt"
                  8⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  PID:4548
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe"
                  8⤵
                  • Suspicious use of SetWindowsHookEx
                  PID:4624
                • C:\Users\Admin\AppData\Roaming\1616801542164.exe
                  "C:\Users\Admin\AppData\Roaming\1616801542164.exe" /sjson "C:\Users\Admin\AppData\Roaming\1616801542164.txt"
                  8⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  PID:4636
                • C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe
                  C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:5116
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\85F91A36E275562F.exe"
                  8⤵
                    PID:4148
                    • C:\Windows\SysWOW64\PING.EXE
                      ping 127.0.0.1 -n 3
                      9⤵
                      • Runs ping.exe
                      PID:2364
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c ping 127.0.0.1 -n 3 & del "C:\Program Files (x86)\ujvqkl7ofji6\aliens.exe"
                  7⤵
                    PID:2304
                    • C:\Windows\SysWOW64\PING.EXE
                      ping 127.0.0.1 -n 3
                      8⤵
                      • Runs ping.exe
                      PID:3992
                  • C:\Users\Admin\AppData\Local\Temp\85F91A36E275562F.exe
                    C:\Users\Admin\AppData\Local\Temp\85F91A36E275562F.exe 200 installp1
                    7⤵
                    • Executes dropped EXE
                    • Checks whether UAC is enabled
                    • Writes to the Master Boot Record (MBR)
                    • Checks SCSI registry key(s)
                    • Suspicious use of SetWindowsHookEx
                    PID:2100
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd.exe /c taskkill /f /im chrome.exe
                      8⤵
                        PID:3724
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /f /im chrome.exe
                          9⤵
                          • Kills process with taskkill
                          PID:4140
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\85F91A36E275562F.exe"
                        8⤵
                          PID:4428
                          • C:\Windows\SysWOW64\PING.EXE
                            ping 127.0.0.1 -n 3
                            9⤵
                            • Runs ping.exe
                            PID:4488
                • C:\Users\Admin\AppData\Local\Temp\RarSFX2\jg2_2qua.exe
                  "C:\Users\Admin\AppData\Local\Temp\RarSFX2\jg2_2qua.exe"
                  4⤵
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3128
                • C:\Users\Admin\AppData\Local\Temp\RarSFX2\file1.exe
                  "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file1.exe"
                  4⤵
                  • Executes dropped EXE
                  • Modifies system certificate store
                  PID:3600
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file1.exe" >> NUL
                    5⤵
                      PID:4212
                      • C:\Windows\SysWOW64\PING.EXE
                        ping 127.0.0.1
                        6⤵
                        • Runs ping.exe
                        PID:4368
                  • C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe
                    "C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"
                    4⤵
                    • Executes dropped EXE
                    PID:4268
                  • C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall21.exe
                    "C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall21.exe"
                    4⤵
                    • Executes dropped EXE
                    PID:4788
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd.exe /c taskkill /f /im chrome.exe
                      5⤵
                        PID:4932
                        • C:\Windows\SysWOW64\taskkill.exe
                          taskkill /f /im chrome.exe
                          6⤵
                          • Kills process with taskkill
                          PID:4976
                    • C:\Users\Admin\AppData\Local\Temp\RarSFX2\hjjgaa.exe
                      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\hjjgaa.exe"
                      4⤵
                      • Executes dropped EXE
                      • Adds Run key to start application
                      PID:5012
                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                        5⤵
                        • Executes dropped EXE
                        PID:5056
                      • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                        5⤵
                        • Executes dropped EXE
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5092
              • C:\Windows\system32\msiexec.exe
                C:\Windows\system32\msiexec.exe /V
                1⤵
                • Enumerates connected drives
                • Drops file in Program Files directory
                • Drops file in Windows directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3004
                • C:\Windows\syswow64\MsiExec.exe
                  C:\Windows\syswow64\MsiExec.exe -Embedding 74230164AC05C749210014AAD41C58D6 C
                  2⤵
                  • Loads dropped DLL
                  PID:1628
                • C:\Windows\system32\srtasks.exe
                  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                  2⤵
                    PID:3408
                • C:\Windows\system32\vssvc.exe
                  C:\Windows\system32\vssvc.exe
                  1⤵
                    PID:4704
                  • \??\c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
                    1⤵
                    • Checks SCSI registry key(s)
                    • Modifies data under HKEY_USERS
                    PID:4328

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • memory/1428-93-0x00007FF9220D0000-0x00007FF92214E000-memory.dmp

                    Filesize

                    504KB

                    Download

                  • memory/1428-94-0x0000000010000000-0x0000000010057000-memory.dmp

                    Filesize

                    348KB

                    Download

                  • memory/1428-101-0x000001B3C08F0000-0x000001B3C08F1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2100-78-0x0000000072440000-0x00000000724D3000-memory.dmp

                    Filesize

                    588KB

                    Download

                  • memory/2100-89-0x00000000041D0000-0x0000000004681000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/2132-47-0x0000000010B30000-0x0000000010B31000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2132-48-0x0000000010C20000-0x0000000010C21000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2132-56-0x0000000010C26000-0x0000000010C27000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2132-51-0x0000000010C23000-0x0000000010C24000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2132-49-0x0000000010C21000-0x0000000010C22000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2132-45-0x0000000010B10000-0x0000000010B11000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2132-42-0x0000000070D50000-0x000000007143E000-memory.dmp

                    Filesize

                    6.9MB

                    Download

                  • memory/2132-55-0x0000000010C24000-0x0000000010C26000-memory.dmp

                    Filesize

                    8KB

                    Download

                  • memory/2132-36-0x0000000072440000-0x00000000724D3000-memory.dmp

                    Filesize

                    588KB

                    Download

                  • memory/2376-26-0x0000000002F70000-0x000000000310C000-memory.dmp

                    Filesize

                    1.6MB

                    Download

                  • memory/2376-60-0x0000000000FD0000-0x0000000000FEB000-memory.dmp

                    Filesize

                    108KB

                    Download

                  • memory/2376-59-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/2376-58-0x0000000003110000-0x00000000031FF000-memory.dmp

                    Filesize

                    956KB

                    Download

                  • memory/2612-76-0x0000000072440000-0x00000000724D3000-memory.dmp

                    Filesize

                    588KB

                    Download

                  • memory/2612-90-0x0000000004240000-0x00000000046F1000-memory.dmp

                    Filesize

                    4.7MB

                    Download

                  • memory/3512-37-0x0000000000400000-0x0000000000983000-memory.dmp

                    Filesize

                    5.5MB

                    Download

                  • memory/3512-29-0x0000000000400000-0x0000000000983000-memory.dmp

                    Filesize

                    5.5MB

                    Download

                  • memory/3600-88-0x0000000001070000-0x000000000107D000-memory.dmp

                    Filesize

                    52KB

                    Download

                  • memory/3828-68-0x0000000010000000-0x000000001033D000-memory.dmp

                    Filesize

                    3.2MB

                    Download

                  • memory/3828-64-0x0000000072440000-0x00000000724D3000-memory.dmp

                    Filesize

                    588KB

                    Download

                  • memory/4092-54-0x0000000072440000-0x00000000724D3000-memory.dmp

                    Filesize

                    588KB

                    Download

                  • memory/4268-113-0x00000000043E0000-0x00000000043E1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/4268-100-0x0000000070450000-0x0000000070B3E000-memory.dmp

                    Filesize

                    6.9MB

                    Download

                  • memory/4268-110-0x00000000022B0000-0x00000000022CD000-memory.dmp

                    Filesize

                    116KB

                    Download

                  • memory/4268-105-0x0000000000160000-0x0000000000161000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/4268-111-0x0000000004B10000-0x0000000004B11000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/4268-109-0x0000000000B80000-0x0000000000B81000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/4324-106-0x0000000072440000-0x00000000724D3000-memory.dmp

                    Filesize

                    588KB

                    Download

                  • memory/4528-123-0x0000017F380C0000-0x0000017F380C1000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/4528-117-0x00007FF9220D0000-0x00007FF92214E000-memory.dmp

                    Filesize

                    504KB

                    Download

                  • memory/4548-121-0x0000000072440000-0x00000000724D3000-memory.dmp

                    Filesize

                    588KB

                    Download

                  • memory/4624-127-0x00007FF9220D0000-0x00007FF92214E000-memory.dmp

                    Filesize

                    504KB

                    Download

                  • memory/4624-132-0x0000028B89670000-0x0000028B89671000-memory.dmp

                    Filesize

                    4KB

                    Download

                  • memory/4636-130-0x0000000072440000-0x00000000724D3000-memory.dmp

                    Filesize

                    588KB

                    Download

                  • memory/5116-155-0x0000000072440000-0x00000000724D3000-memory.dmp

                    Filesize

                    588KB

                    Download