Analysis
-
max time kernel
137s -
max time network
137s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
13-04-2021 09:04
Static task
static1
Behavioral task
behavioral1
Sample
invoice.scr
Resource
win7v20210408
General
-
Target
invoice.scr
-
Size
356KB
-
MD5
0f62ad64933edb9e9a62124f8f965d8c
-
SHA1
56f858b120126d45e384da71cc198a4f8f87870f
-
SHA256
c6971c3516ab280c7c6985ccc94062547116fcd3a7593fc84704030169c16e59
-
SHA512
61e28fd209bbe5ee006e5afc751fe441a89d98ca2471139ff5c6f825af402b408d90d8fab8acf51116d09e6d4329220f6a24238f8bdd282711181cf6231c677e
Malware Config
Extracted
azorult
https://sterline.lt/lokk/32/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
invoice.scrdescription pid process target process PID 2840 set thread context of 3000 2840 invoice.scr invoice.scr -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
invoice.scrdescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 invoice.scr Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString invoice.scr -
Processes:
invoice.scrdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 invoice.scr Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e invoice.scr -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
invoice.scrinvoice.scrpid process 2840 invoice.scr 2840 invoice.scr 2840 invoice.scr 2840 invoice.scr 2840 invoice.scr 2840 invoice.scr 3000 invoice.scr 3000 invoice.scr -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
invoice.scrdescription pid process Token: SeDebugPrivilege 2840 invoice.scr -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
invoice.scrdescription pid process target process PID 2840 wrote to memory of 2124 2840 invoice.scr invoice.scr PID 2840 wrote to memory of 2124 2840 invoice.scr invoice.scr PID 2840 wrote to memory of 2124 2840 invoice.scr invoice.scr PID 2840 wrote to memory of 3000 2840 invoice.scr invoice.scr PID 2840 wrote to memory of 3000 2840 invoice.scr invoice.scr PID 2840 wrote to memory of 3000 2840 invoice.scr invoice.scr PID 2840 wrote to memory of 3000 2840 invoice.scr invoice.scr PID 2840 wrote to memory of 3000 2840 invoice.scr invoice.scr PID 2840 wrote to memory of 3000 2840 invoice.scr invoice.scr PID 2840 wrote to memory of 3000 2840 invoice.scr invoice.scr PID 2840 wrote to memory of 3000 2840 invoice.scr invoice.scr PID 2840 wrote to memory of 3000 2840 invoice.scr invoice.scr
Processes
-
C:\Users\Admin\AppData\Local\Temp\invoice.scr"C:\Users\Admin\AppData\Local\Temp\invoice.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\invoice.scrC:\Users\Admin\AppData\Local\Temp\invoice.scr2⤵
-
C:\Users\Admin\AppData\Local\Temp\invoice.scrC:\Users\Admin\AppData\Local\Temp\invoice.scr2⤵
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2840-114-0x0000000000A30000-0x0000000000A31000-memory.dmpFilesize
4KB
-
memory/2840-116-0x0000000005290000-0x0000000005291000-memory.dmpFilesize
4KB
-
memory/2840-117-0x0000000005240000-0x0000000005242000-memory.dmpFilesize
8KB
-
memory/2840-118-0x00000000052A0000-0x00000000052F3000-memory.dmpFilesize
332KB
-
memory/2840-119-0x0000000005390000-0x0000000005391000-memory.dmpFilesize
4KB
-
memory/2840-120-0x0000000005CF0000-0x0000000005CF1000-memory.dmpFilesize
4KB
-
memory/3000-121-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3000-122-0x000000000041A1F8-mapping.dmp
-
memory/3000-123-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB