Overview

overview

10

Static

static

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ฺฺ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows7_x64

10

Resubmissions

06-04-2021 13:50

210406-gc51ndzsc2 10

26-03-2021 23:40

210326-d1ybrjhevx 10

13-03-2021 17:16

210313-8s7b52z63e 10

05-03-2021 14:52

210305-34k3zj54f2 10

01-03-2021 13:17

210301-naamxpgf4e 10

28-02-2021 20:46

210228-6q3b959xae 10

28-02-2021 20:15

210228-mbr268za12 10

28-02-2021 18:32

210228-h944b5cpxa 10

28-02-2021 15:10

210228-hnwwpyjy7j 10

Analysis

  • max time kernel
    245s
  • max time network
    294s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    06-04-2021 13:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    [CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe

  • Size

    9.2MB

  • MD5

    b806267b5f3b7760df56396b1cf05e6d

  • SHA1

    5166d4c1d3e476281d9e991eababc3e4aa9ec5ad

  • SHA256

    f95d12a0dbd8199d16f48d8e4cbe69a8d4ec16c534efb36e52a662664e1c1783

  • SHA512

    30e393bb3898edc8ab5fb04e62ce421ddf3903075f59e3880408b300f46bb74a85088336d6e1203b2101152cebeef4c1730290b41ca77604ecb722c8f627328b

Score
10/10
azorultplugxxmrigbootkitdiscoveryevasioninfostealermacrominerpersistencespywarestealertrojanupxxlm

Malware Config

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    trojanplugx
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Nirsoft 4 IoCs
  • XMRig Miner Payload 4 IoCs
    miner
  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 21 IoCs
  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

    macroxlm
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
    "C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4688
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:412
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
        keygen-pr.exe -p83fsase3Ge
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3860
        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1056
          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
            C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe -txt -scanlocal -file:potato.dat
            5⤵
              PID:1576
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
          keygen-step-1.exe
          3⤵
          • Executes dropped EXE
          PID:3188
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
          keygen-step-4.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2924
          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe
            "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"
            4⤵
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Writes to the Master Boot Record (MBR)
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Modifies system certificate store
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:520
            • C:\Windows\SysWOW64\msiexec.exe
              msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"
              5⤵
              • Enumerates connected drives
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              PID:2452
            • C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe
              C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe 0011 installp1
              5⤵
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Writes to the Master Boot Record (MBR)
              • Suspicious use of SetThreadContext
              • Checks SCSI registry key(s)
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2644
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe"
                6⤵
                  PID:4396
                • C:\Users\Admin\AppData\Roaming\1617716850075.exe
                  "C:\Users\Admin\AppData\Roaming\1617716850075.exe" /sjson "C:\Users\Admin\AppData\Roaming\1617716850075.txt"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  PID:1400
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe"
                  6⤵
                  • Suspicious use of SetWindowsHookEx
                  PID:4752
                • C:\Users\Admin\AppData\Roaming\1617716854238.exe
                  "C:\Users\Admin\AppData\Roaming\1617716854238.exe" /sjson "C:\Users\Admin\AppData\Roaming\1617716854238.txt"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of SetWindowsHookEx
                  PID:4776
                • C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe
                  C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3172
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe"
                  6⤵
                    PID:3256
                    • C:\Windows\SysWOW64\PING.EXE
                      ping 127.0.0.1 -n 3
                      7⤵
                      • Runs ping.exe
                      PID:3696
                • C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe
                  C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe 200 installp1
                  5⤵
                  • Executes dropped EXE
                  • Checks whether UAC is enabled
                  • Writes to the Master Boot Record (MBR)
                  • Checks SCSI registry key(s)
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:4656
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /c taskkill /f /im chrome.exe
                    6⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4416
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /f /im chrome.exe
                      7⤵
                      • Kills process with taskkill
                      PID:4512
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe"
                    6⤵
                      PID:1776
                      • C:\Windows\SysWOW64\PING.EXE
                        ping 127.0.0.1 -n 3
                        7⤵
                        • Runs ping.exe
                        PID:1180
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3908
                    • C:\Windows\SysWOW64\PING.EXE
                      ping 127.0.0.1 -n 3
                      6⤵
                      • Runs ping.exe
                      PID:4596
                • C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe
                  "C:\Users\Admin\AppData\Local\Temp\RarSFX1\Install.exe"
                  4⤵
                    PID:4408
                  • C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe
                    "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"
                    4⤵
                    • Executes dropped EXE
                    • Modifies data under HKEY_USERS
                    • Modifies system certificate store
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4564
                    • C:\Users\Admin\AppData\Roaming\7620.tmp.exe
                      "C:\Users\Admin\AppData\Roaming\7620.tmp.exe"
                      5⤵
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Suspicious use of SetThreadContext
                      PID:672
                      • C:\Windows\system32\msiexec.exe
                        -o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8.w23914 --cpu-max-threads-hint 50 -r 9999
                        6⤵
                        • Blocklisted process makes network request
                        PID:3676
                      • C:\Windows\system32\msiexec.exe
                        -P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.w31697@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 99999
                        6⤵
                          PID:2340
                      • C:\Users\Admin\AppData\Roaming\7769.tmp.exe
                        "C:\Users\Admin\AppData\Roaming\7769.tmp.exe"
                        5⤵
                        • Executes dropped EXE
                        PID:3392
                        • C:\Windows\SysWOW64\cmd.exe
                          /c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Roaming\7769.tmp.exe
                          6⤵
                            PID:1564
                            • C:\Windows\SysWOW64\timeout.exe
                              timeout /t 3
                              7⤵
                              • Delays execution with timeout.exe
                              PID:4916
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"
                          5⤵
                            PID:4840
                            • C:\Windows\SysWOW64\PING.EXE
                              ping 127.0.0.1
                              6⤵
                              • Executes dropped EXE
                              • Runs ping.exe
                              PID:4408
                        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe
                          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"
                          4⤵
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          PID:4600
                        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe
                          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"
                          4⤵
                          • Executes dropped EXE
                          PID:4036
                        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe
                          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"
                          4⤵
                          • Executes dropped EXE
                          PID:812
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd.exe /c taskkill /f /im chrome.exe
                            5⤵
                              PID:4428
                              • C:\Windows\SysWOW64\taskkill.exe
                                taskkill /f /im chrome.exe
                                6⤵
                                • Kills process with taskkill
                                PID:2976
                          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe
                            "C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe"
                            4⤵
                            • Executes dropped EXE
                            • Adds Run key to start application
                            PID:4668
                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                              5⤵
                              • Executes dropped EXE
                              PID:3708
                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                              5⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4576
                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
                          keygen-step-3.exe
                          3⤵
                          • Executes dropped EXE
                          • Suspicious use of WriteProcessMemory
                          PID:4072
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
                            4⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1392
                            • C:\Windows\SysWOW64\PING.EXE
                              ping 1.1.1.1 -n 1 -w 3000
                              5⤵
                              • Runs ping.exe
                              PID:1616
                    • C:\Windows\system32\msiexec.exe
                      C:\Windows\system32\msiexec.exe /V
                      1⤵
                      • Enumerates connected drives
                      • Drops file in Program Files directory
                      • Drops file in Windows directory
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:184
                      • C:\Windows\syswow64\MsiExec.exe
                        C:\Windows\syswow64\MsiExec.exe -Embedding 7B430F76A175F68B2474BF505717A926 C
                        2⤵
                        • Loads dropped DLL
                        PID:1328
                      • C:\Windows\system32\srtasks.exe
                        C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                        2⤵
                          PID:3996
                      • C:\Windows\system32\vssvc.exe
                        C:\Windows\system32\vssvc.exe
                        1⤵
                          PID:4736
                        • \??\c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
                          1⤵
                          • Checks SCSI registry key(s)
                          • Modifies data under HKEY_USERS
                          • Suspicious use of SetWindowsHookEx
                          PID:4396

                        Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • memory/520-25-0x0000000072AE0000-0x0000000072B73000-memory.dmp

                          Filesize

                          588KB

                          Download

                        • memory/520-29-0x0000000010000000-0x000000001033E000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/1056-27-0x0000000002D50000-0x0000000002EEC000-memory.dmp

                          Filesize

                          1.6MB

                          Download

                        • memory/1400-83-0x0000000072AE0000-0x0000000072B73000-memory.dmp

                          Filesize

                          588KB

                          Download

                        • memory/2340-100-0x0000000140000000-0x0000000140383000-memory.dmp

                          Filesize

                          3.5MB

                          Download

                        • memory/2340-90-0x0000000140000000-0x0000000140383000-memory.dmp

                          Filesize

                          3.5MB

                          Download

                        • memory/2644-54-0x0000000010000000-0x000000001033E000-memory.dmp

                          Filesize

                          3.2MB

                          Download

                        • memory/2644-37-0x0000000072AE0000-0x0000000072B73000-memory.dmp

                          Filesize

                          588KB

                          Download

                        • memory/2644-65-0x0000000002CC0000-0x0000000003169000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/3172-114-0x0000000072AE0000-0x0000000072B73000-memory.dmp

                          Filesize

                          588KB

                          Download

                        • memory/3392-118-0x0000000000400000-0x000000000587C000-memory.dmp

                          Filesize

                          84.5MB

                          Download

                        • memory/3392-110-0x00000000075C0000-0x000000000CA3C000-memory.dmp

                          Filesize

                          84.5MB

                          Download

                        • memory/3676-104-0x00000266A04F0000-0x00000266A0510000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/3676-102-0x0000000140000000-0x000000014070A000-memory.dmp

                          Filesize

                          7.0MB

                          Download

                        • memory/3676-89-0x0000000140000000-0x000000014070A000-memory.dmp

                          Filesize

                          7.0MB

                          Download

                        • memory/3676-84-0x0000000140000000-0x000000014070A000-memory.dmp

                          Filesize

                          7.0MB

                          Download

                        • memory/3676-88-0x000002660E380000-0x000002660E394000-memory.dmp

                          Filesize

                          80KB

                          Download

                        • memory/3676-155-0x00000266A0940000-0x00000266A0960000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/4036-127-0x0000000000D40000-0x0000000000D41000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/4036-130-0x000000001B140000-0x000000001B142000-memory.dmp

                          Filesize

                          8KB

                          Download

                        • memory/4036-129-0x0000000000D50000-0x0000000000D51000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/4036-128-0x0000000002620000-0x0000000002653000-memory.dmp

                          Filesize

                          204KB

                          Download

                        • memory/4036-124-0x00007FFEE73A0000-0x00007FFEE7D8C000-memory.dmp

                          Filesize

                          9.9MB

                          Download

                        • memory/4036-125-0x0000000000610000-0x0000000000611000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/4396-79-0x0000017A4D600000-0x0000017A4D601000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/4396-70-0x0000000010000000-0x0000000010057000-memory.dmp

                          Filesize

                          348KB

                          Download

                        • memory/4396-69-0x00007FFF00300000-0x00007FFF0037E000-memory.dmp

                          Filesize

                          504KB

                          Download

                        • memory/4408-44-0x00007FFEE8270000-0x00007FFEE8C5C000-memory.dmp

                          Filesize

                          9.9MB

                          Download

                        • memory/4408-45-0x0000000000810000-0x0000000000811000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/4408-49-0x0000000002940000-0x0000000002942000-memory.dmp

                          Filesize

                          8KB

                          Download

                        • memory/4564-81-0x0000000000400000-0x0000000000448000-memory.dmp

                          Filesize

                          288KB

                          Download

                        • memory/4564-56-0x0000000001350000-0x000000000135D000-memory.dmp

                          Filesize

                          52KB

                          Download

                        • memory/4656-66-0x0000000002D00000-0x00000000031AF000-memory.dmp

                          Filesize

                          4.7MB

                          Download

                        • memory/4656-38-0x0000000072AE0000-0x0000000072B73000-memory.dmp

                          Filesize

                          588KB

                          Download

                        • memory/4752-101-0x000002A31BDE0000-0x000002A31BDE1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/4752-95-0x00007FFF00300000-0x00007FFF0037E000-memory.dmp

                          Filesize

                          504KB

                          Download

                        • memory/4776-99-0x0000000072AE0000-0x0000000072B73000-memory.dmp

                          Filesize

                          588KB

                          Download