Overview

overview

10

Static

static

New Order.exe

windows7_x64

10

New Order.exe

windows10_x64

10

Analysis

  • max time kernel
    120s
  • max time network
    131s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    22-04-2021 00:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    New Order.exe

  • Size

    785KB

  • MD5

    23df9b65361d18bcbab8d29f6a0b99c8

  • SHA1

    f895389d4f366f7fcdced202ea7357195d8a8373

  • SHA256

    fe740b0963f4003fcffab9a6455b66c78b1844c5b48fe0e61a68804484620f65

  • SHA512

    09057fb93f8d1faa032b3414e1c34b804047eec36443d24242f568c96261f85629f487ab4373c6540e8f34d1d583182867bc3e9f0bb030c1faa4d508f27b8d44

Score
10/10
azorultinfostealertrojan

Malware Config

Extracted

Family

azorult

C2

http://149.248.35.254/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\New Order.exe
    "C:\Users\Admin\AppData\Local\Temp\New Order.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4000
    • C:\Users\Admin\AppData\Local\Temp\New Order.exe
      "{path}"
      2⤵
        PID:2712
    • C:\Windows\System32\SystemSettingsBroker.exe
      C:\Windows\System32\SystemSettingsBroker.exe -Embedding
      1⤵
        PID:3288
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s RmSvc
        1⤵
          PID:1340
        • \??\c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k localservice -s SstpSvc
          1⤵
            PID:1680
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
            1⤵
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Modifies data under HKEY_USERS
            PID:3704
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
            1⤵
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            PID:1844
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s RasMan
            1⤵
              PID:200

            Network

            MITRE ATT&CK Matrix ATT&CK v6

            Initial Access

            Execution

            Persistence

            Privilege Escalation

            Defense Evasion

            Credential Access

            Discovery

            Query Registry

            1
            T1012

            Peripheral Device Discovery

            1
            T1120

            System Information Discovery

            1
            T1082

            Lateral Movement

            Collection

            Exfiltration

            Command and Control

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Windows\INF\netrasa.PNF
              MD5

              80648b43d233468718d717d10187b68d

              SHA1

              a1736e8f0e408ce705722ce097d1adb24ebffc45

              SHA256

              8ab9a39457507e405ade5ef9d723e0f89bc46d8d8b33d354b00d95847f098380

              SHA512

              eec0ac7e7abcf87b3f0f4522b0dd95c658327afb866ceecff3c9ff0812a521201d729dd71d43f3ac46536f8435d4a49ac157b6282077c7c1940a6668f3b3aea9

              Download Submit
            • C:\Windows\INF\netsstpa.PNF
              MD5

              01e21456e8000bab92907eec3b3aeea9

              SHA1

              39b34fe438352f7b095e24c89968fca48b8ce11c

              SHA256

              35ad0403fdef3fce3ef5cd311c72fef2a95a317297a53c02735cda4bd6e0c74f

              SHA512

              9d5153450e8fe3f51f20472bae4a2ab2fed43fad61a89b04a70325559f6ffed935dd72212671cc6cfc0288458d359bc71567f0d9af8e5770d696adc5bdadd7ec

              Download Submit
            • memory/2712-115-0x0000000000400000-0x0000000000420000-memory.dmp
              Filesize

              128KB

              Download
            • memory/2712-116-0x000000000041A1F8-mapping.dmp
              Download
            • memory/2712-117-0x0000000000400000-0x0000000000420000-memory.dmp
              Filesize

              128KB

              Download
            • memory/4000-114-0x0000000002CA0000-0x0000000002CA1000-memory.dmp
              Filesize

              4KB

              Download