Analysis
- max time kernel
197s - max time network
228s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
10/02/2022, 04:31
Static task
static1
Behavioral task
behavioral1
Sample
d6a9b0467cefd7faf593cfd666edd3a2.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target d6a9b0467cefd7faf593cfd666edd3a2.exe
- Size 735KB
- Sample220210-e5hbladggl
- SHA256 fd5e6989ff1e8e4ef24bbb2b67018ef8adbdf0da5d489cd142fd8e1a033ce92e
- MD5 d6a9b0467cefd7faf593cfd666edd3a2
- SHA1 0a7f0528da4ef476c96b6f3d33320add4dbd1eec
- SHA512 66f06b9fff1519b9fc17eb6ed396aea39c892769c71279144af661f62c4d2fa8d2fc6a708233593b66416e574efefc3c6db917ed505a02dd6a3b232ebece540c
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
azorult
C2
-
http://australiadish.bar/kendrick/index.php
Signatures
- Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
- suricata: ET MALWARE AZORult v3.3 Server Response M2
suricata: ET MALWARE AZORult v3.3 Server Response M2
- suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M13
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M13
- Loads dropped DLL 6 IoCs
pid Process 2312 d6a9b0467cefd7faf593cfd666edd3a2.exe 2312 d6a9b0467cefd7faf593cfd666edd3a2.exe 2312 d6a9b0467cefd7faf593cfd666edd3a2.exe 2312 d6a9b0467cefd7faf593cfd666edd3a2.exe 2312 d6a9b0467cefd7faf593cfd666edd3a2.exe 2312 d6a9b0467cefd7faf593cfd666edd3a2.exe - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4208 set thread context of 2312 4208 d6a9b0467cefd7faf593cfd666edd3a2.exe 92 - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe - Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3804 svchost.exe Token: SeCreatePagefilePrivilege 3804 svchost.exe Token: SeShutdownPrivilege 3804 svchost.exe Token: SeCreatePagefilePrivilege 3804 svchost.exe Token: SeShutdownPrivilege 3804 svchost.exe Token: SeCreatePagefilePrivilege 3804 svchost.exe Token: SeSecurityPrivilege 1752 TiWorker.exe Token: SeRestorePrivilege 1752 TiWorker.exe Token: SeBackupPrivilege 1752 TiWorker.exe Token: SeBackupPrivilege 1752 TiWorker.exe Token: SeRestorePrivilege 1752 TiWorker.exe Token: SeSecurityPrivilege 1752 TiWorker.exe Token: SeBackupPrivilege 1752 TiWorker.exe Token: SeRestorePrivilege 1752 TiWorker.exe Token: SeSecurityPrivilege 1752 TiWorker.exe Token: SeBackupPrivilege 1752 TiWorker.exe Token: SeRestorePrivilege 1752 TiWorker.exe Token: SeSecurityPrivilege 1752 TiWorker.exe Token: SeBackupPrivilege 1752 TiWorker.exe Token: SeRestorePrivilege 1752 TiWorker.exe Token: SeSecurityPrivilege 1752 TiWorker.exe Token: SeBackupPrivilege 1752 TiWorker.exe Token: SeRestorePrivilege 1752 TiWorker.exe Token: SeSecurityPrivilege 1752 TiWorker.exe Token: SeBackupPrivilege 1752 TiWorker.exe Token: SeRestorePrivilege 1752 TiWorker.exe Token: SeSecurityPrivilege 1752 TiWorker.exe Token: SeBackupPrivilege 1752 TiWorker.exe Token: SeRestorePrivilege 1752 TiWorker.exe Token: SeSecurityPrivilege 1752 TiWorker.exe Token: SeBackupPrivilege 1752 TiWorker.exe Token: SeRestorePrivilege 1752 TiWorker.exe Token: SeSecurityPrivilege 1752 TiWorker.exe Token: SeBackupPrivilege 1752 TiWorker.exe Token: SeRestorePrivilege 1752 TiWorker.exe Token: SeSecurityPrivilege 1752 TiWorker.exe Token: SeBackupPrivilege 1752 TiWorker.exe Token: SeRestorePrivilege 1752 TiWorker.exe Token: SeSecurityPrivilege 1752 TiWorker.exe Token: SeBackupPrivilege 1752 TiWorker.exe Token: SeRestorePrivilege 1752 TiWorker.exe Token: SeSecurityPrivilege 1752 TiWorker.exe Token: SeBackupPrivilege 1752 TiWorker.exe Token: SeRestorePrivilege 1752 TiWorker.exe Token: SeSecurityPrivilege 1752 TiWorker.exe Token: SeBackupPrivilege 1752 TiWorker.exe Token: SeRestorePrivilege 1752 TiWorker.exe Token: SeSecurityPrivilege 1752 TiWorker.exe Token: SeBackupPrivilege 1752 TiWorker.exe Token: SeRestorePrivilege 1752 TiWorker.exe Token: SeSecurityPrivilege 1752 TiWorker.exe Token: SeBackupPrivilege 1752 TiWorker.exe Token: SeRestorePrivilege 1752 TiWorker.exe Token: SeSecurityPrivilege 1752 TiWorker.exe Token: SeBackupPrivilege 1752 TiWorker.exe Token: SeRestorePrivilege 1752 TiWorker.exe Token: SeSecurityPrivilege 1752 TiWorker.exe Token: SeBackupPrivilege 1752 TiWorker.exe Token: SeRestorePrivilege 1752 TiWorker.exe Token: SeSecurityPrivilege 1752 TiWorker.exe Token: SeBackupPrivilege 1752 TiWorker.exe Token: SeRestorePrivilege 1752 TiWorker.exe Token: SeSecurityPrivilege 1752 TiWorker.exe Token: SeBackupPrivilege 1752 TiWorker.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4208 wrote to memory of 2312 4208 d6a9b0467cefd7faf593cfd666edd3a2.exe 92 PID 4208 wrote to memory of 2312 4208 d6a9b0467cefd7faf593cfd666edd3a2.exe 92 PID 4208 wrote to memory of 2312 4208 d6a9b0467cefd7faf593cfd666edd3a2.exe 92 PID 4208 wrote to memory of 2312 4208 d6a9b0467cefd7faf593cfd666edd3a2.exe 92 PID 4208 wrote to memory of 2312 4208 d6a9b0467cefd7faf593cfd666edd3a2.exe 92 PID 4208 wrote to memory of 2312 4208 d6a9b0467cefd7faf593cfd666edd3a2.exe 92 PID 4208 wrote to memory of 2312 4208 d6a9b0467cefd7faf593cfd666edd3a2.exe 92 PID 4208 wrote to memory of 2312 4208 d6a9b0467cefd7faf593cfd666edd3a2.exe 92 PID 4208 wrote to memory of 2312 4208 d6a9b0467cefd7faf593cfd666edd3a2.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6a9b0467cefd7faf593cfd666edd3a2.exe"C:\Users\Admin\AppData\Local\Temp\d6a9b0467cefd7faf593cfd666edd3a2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\d6a9b0467cefd7faf593cfd666edd3a2.exe"C:\Users\Admin\AppData\Local\Temp\d6a9b0467cefd7faf593cfd666edd3a2.exe"2⤵
- Loads dropped DLL
PID:2312
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
PID:1796
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3804
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1752