Analysis
-
max time kernel
104s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
14-05-2022 13:50
Static task
static1
Behavioral task
behavioral1
Sample
55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe
Resource
win10v2004-20220414-en
General
-
Target
55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe
-
Size
1.7MB
-
MD5
10fa511e7a230d443c6bbc008ebdf1c7
-
SHA1
976e29b1b050a70448ea23976deb8b7f24594e36
-
SHA256
55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69
-
SHA512
4a2a854bcdcab4ef0fef9cf33814d9dd08f72444079ae29b3228f631e7520ac2a570b1da20c5f76ab2cc4ad88b8073f98a12e27820a3d2f0d559d3606ba5c395
Malware Config
Extracted
azorult
http://bl1we4t.xyz/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\engr = "\"C:\\Users\\Admin\\AppData\\Local\\engr.exe\"" 55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exedescription pid process target process PID 904 set thread context of 2032 904 55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe 55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2020 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exepid process 904 55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exedescription pid process Token: SeDebugPrivilege 904 55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.execmd.exedescription pid process target process PID 904 wrote to memory of 948 904 55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe cmd.exe PID 904 wrote to memory of 948 904 55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe cmd.exe PID 904 wrote to memory of 948 904 55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe cmd.exe PID 904 wrote to memory of 948 904 55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe cmd.exe PID 948 wrote to memory of 2020 948 cmd.exe timeout.exe PID 948 wrote to memory of 2020 948 cmd.exe timeout.exe PID 948 wrote to memory of 2020 948 cmd.exe timeout.exe PID 948 wrote to memory of 2020 948 cmd.exe timeout.exe PID 904 wrote to memory of 2032 904 55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe 55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe PID 904 wrote to memory of 2032 904 55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe 55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe PID 904 wrote to memory of 2032 904 55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe 55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe PID 904 wrote to memory of 2032 904 55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe 55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe PID 904 wrote to memory of 2032 904 55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe 55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe PID 904 wrote to memory of 2032 904 55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe 55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe PID 904 wrote to memory of 2032 904 55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe 55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe PID 904 wrote to memory of 2032 904 55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe 55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe PID 904 wrote to memory of 2032 904 55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe 55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe PID 904 wrote to memory of 2032 904 55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe 55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe"C:\Users\Admin\AppData\Local\Temp\55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 202⤵
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\timeout.exetimeout 203⤵
- Delays execution with timeout.exe
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exeC:\Users\Admin\AppData\Local\Temp\55d6cf850bc8e1f91d1d5b0905eed004df00da757e7ffc80fead608ff18f1e69.exe2⤵PID:2032
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/904-54-0x00000000011D0000-0x000000000137C000-memory.dmpFilesize
1.7MB
-
memory/904-55-0x0000000004A50000-0x0000000004BF4000-memory.dmpFilesize
1.6MB
-
memory/904-58-0x0000000000490000-0x00000000004A6000-memory.dmpFilesize
88KB
-
memory/948-56-0x0000000000000000-mapping.dmp
-
memory/2020-57-0x0000000000000000-mapping.dmp
-
memory/2032-60-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2032-59-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2032-62-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2032-63-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2032-64-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2032-67-0x000000000041A684-mapping.dmp
-
memory/2032-66-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2032-69-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2032-70-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2032-71-0x00000000755A1000-0x00000000755A3000-memory.dmpFilesize
8KB