Analysis
- max time kernel
6s - max time network
94s - platform
windows7_x64 - resource
win7v20210410 - submitted
08/05/2021, 20:35
General
- Target e40630059f781ce323021a6d26ba6f7806061aede715b94ad0288e01d79cbad8.exe
- Size 2.0MB
- Sample210508-1pg648dq4a
- SHA256 e40630059f781ce323021a6d26ba6f7806061aede715b94ad0288e01d79cbad8
Malware Config
Extracted
-
azorult
-
http://0x21.in:8000/_az/
Signatures
- Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 8 IoCs
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of WriteProcessMemory 25 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e40630059f781ce323021a6d26ba6f7806061aede715b94ad0288e01d79cbad8.exe"C:\Users\Admin\AppData\Local\Temp\e40630059f781ce323021a6d26ba6f7806061aede715b94ad0288e01d79cbad8.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵
- Maps connected drives based on registry
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\6Dj1UhXQhBoM.bat" "4⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- Runs ping.exe
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"5⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 14804⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\e40630059f781ce323021a6d26ba6f7806061aede715b94ad0288e01d79cbad8.exe"C:\Users\Admin\AppData\Local\Temp\e40630059f781ce323021a6d26ba6f7806061aede715b94ad0288e01d79cbad8.exe"2⤵
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {EB85E022-A8D5-472F-83B0-98911BB0F930} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]1⤵
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeC:\Users\Admin\btpanui\SystemPropertiesPerformance.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"3⤵
-
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"3⤵
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1104-128-0x0000000004880000-0x0000000004881000-memory.dmp
memory/1104-118-0x0000000000EA0000-0x0000000000EA1000-memory.dmp
memory/1260-141-0x0000000000480000-0x0000000000481000-memory.dmp
memory/1420-59-0x0000000074FB1000-0x0000000074FB3000-memory.dmp
memory/1420-84-0x00000000010C0000-0x00000000010C1000-memory.dmp
memory/1720-75-0x0000000000080000-0x00000000000A0000-memory.dmp
memory/1740-87-0x00000000048C0000-0x00000000048C1000-memory.dmp
memory/1740-81-0x00000000008B0000-0x00000000008B1000-memory.dmp
memory/1776-119-0x00000000002C0000-0x000000000035C000-memory.dmp
memory/1776-117-0x0000000000020000-0x0000000000021000-memory.dmp
memory/1780-146-0x0000000004A00000-0x0000000004A01000-memory.dmp
memory/1792-85-0x0000000000020000-0x0000000000021000-memory.dmp
memory/1792-86-0x0000000000280000-0x000000000031C000-memory.dmp
memory/1832-93-0x00000000003D0000-0x00000000003D1000-memory.dmp
memory/1832-95-0x0000000000350000-0x0000000000351000-memory.dmp