Analysis
-
max time kernel
138s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 01:45
Static task
static1
Behavioral task
behavioral1
Sample
_____640.exe
Resource
win7-20220414-en
General
-
Target
_____640.exe
-
Size
931KB
-
MD5
836cda1d8a9718485cc9f9653530c2d9
-
SHA1
fca85ff9aa624547d9a315962d82388c300edac1
-
SHA256
d3793a581da66ef5840648574ce364846e7c68a559c0f5e49faf9e4892ecdc72
-
SHA512
07ca078d79f622706d08a534f6b5e2c896152fb0d0e452781fa6be5dc90028fdf074b3b78acac438f2acf5b3f5522e70afb7db4551874a3083860213e2790481
Malware Config
Extracted
netwire
174.127.99.159:7882
-
activex_autorun
false
- activex_key
-
copy_executable
false
-
delete_original
false
-
host_id
May-B
- install_path
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
- mutex
-
offline_keylogger
true
-
password
Password
-
registry_autorun
false
- startup_name
-
use_mutex
false
Extracted
azorult
https://gemateknindoperkasa.co.id/imag/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/5052-137-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/5052-140-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/5052-146-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Executes dropped EXE 4 IoCs
Processes:
File.exesvhost.exetmp.exesvhost.exepid process 1272 File.exe 5052 svhost.exe 1288 tmp.exe 3516 svhost.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
_____640.exeFile.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation _____640.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation File.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
_____640.exeFile.exedescription pid process target process PID 4832 set thread context of 5052 4832 _____640.exe svhost.exe PID 1272 set thread context of 3516 1272 File.exe svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1576 3516 WerFault.exe svhost.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4788 timeout.exe -
NTFS ADS 2 IoCs
Processes:
cmd.execmd.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier cmd.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier cmd.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
_____640.exeFile.exepid process 4832 _____640.exe 1272 File.exe 4832 _____640.exe 1272 File.exe 4832 _____640.exe 1272 File.exe 4832 _____640.exe 1272 File.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
_____640.exeFile.exedescription pid process Token: SeDebugPrivilege 4832 _____640.exe Token: SeDebugPrivilege 1272 File.exe -
Suspicious use of WriteProcessMemory 56 IoCs
Processes:
_____640.exeFile.execmd.execmd.execmd.exedescription pid process target process PID 4832 wrote to memory of 1272 4832 _____640.exe File.exe PID 4832 wrote to memory of 1272 4832 _____640.exe File.exe PID 4832 wrote to memory of 1272 4832 _____640.exe File.exe PID 4832 wrote to memory of 5052 4832 _____640.exe svhost.exe PID 4832 wrote to memory of 5052 4832 _____640.exe svhost.exe PID 4832 wrote to memory of 5052 4832 _____640.exe svhost.exe PID 4832 wrote to memory of 5052 4832 _____640.exe svhost.exe PID 4832 wrote to memory of 5052 4832 _____640.exe svhost.exe PID 4832 wrote to memory of 5052 4832 _____640.exe svhost.exe PID 4832 wrote to memory of 5052 4832 _____640.exe svhost.exe PID 4832 wrote to memory of 5052 4832 _____640.exe svhost.exe PID 4832 wrote to memory of 5052 4832 _____640.exe svhost.exe PID 4832 wrote to memory of 5052 4832 _____640.exe svhost.exe PID 4832 wrote to memory of 5052 4832 _____640.exe svhost.exe PID 1272 wrote to memory of 1288 1272 File.exe tmp.exe PID 1272 wrote to memory of 1288 1272 File.exe tmp.exe PID 1272 wrote to memory of 1288 1272 File.exe tmp.exe PID 4832 wrote to memory of 2132 4832 _____640.exe cmd.exe PID 4832 wrote to memory of 2132 4832 _____640.exe cmd.exe PID 4832 wrote to memory of 2132 4832 _____640.exe cmd.exe PID 1272 wrote to memory of 3516 1272 File.exe svhost.exe PID 1272 wrote to memory of 3516 1272 File.exe svhost.exe PID 1272 wrote to memory of 3516 1272 File.exe svhost.exe PID 1272 wrote to memory of 3516 1272 File.exe svhost.exe PID 1272 wrote to memory of 3516 1272 File.exe svhost.exe PID 1272 wrote to memory of 3516 1272 File.exe svhost.exe PID 1272 wrote to memory of 3516 1272 File.exe svhost.exe PID 1272 wrote to memory of 3516 1272 File.exe svhost.exe PID 1272 wrote to memory of 3516 1272 File.exe svhost.exe PID 4832 wrote to memory of 4400 4832 _____640.exe cmd.exe PID 4832 wrote to memory of 4400 4832 _____640.exe cmd.exe PID 4832 wrote to memory of 4400 4832 _____640.exe cmd.exe PID 1272 wrote to memory of 1488 1272 File.exe cmd.exe PID 1272 wrote to memory of 1488 1272 File.exe cmd.exe PID 1272 wrote to memory of 1488 1272 File.exe cmd.exe PID 4400 wrote to memory of 5056 4400 cmd.exe reg.exe PID 4400 wrote to memory of 5056 4400 cmd.exe reg.exe PID 4400 wrote to memory of 5056 4400 cmd.exe reg.exe PID 1272 wrote to memory of 2824 1272 File.exe cmd.exe PID 1272 wrote to memory of 2824 1272 File.exe cmd.exe PID 1272 wrote to memory of 2824 1272 File.exe cmd.exe PID 4832 wrote to memory of 4748 4832 _____640.exe cmd.exe PID 4832 wrote to memory of 4748 4832 _____640.exe cmd.exe PID 4832 wrote to memory of 4748 4832 _____640.exe cmd.exe PID 2824 wrote to memory of 4104 2824 cmd.exe reg.exe PID 2824 wrote to memory of 4104 2824 cmd.exe reg.exe PID 2824 wrote to memory of 4104 2824 cmd.exe reg.exe PID 4832 wrote to memory of 216 4832 _____640.exe cmd.exe PID 4832 wrote to memory of 216 4832 _____640.exe cmd.exe PID 4832 wrote to memory of 216 4832 _____640.exe cmd.exe PID 1272 wrote to memory of 376 1272 File.exe cmd.exe PID 1272 wrote to memory of 376 1272 File.exe cmd.exe PID 1272 wrote to memory of 376 1272 File.exe cmd.exe PID 216 wrote to memory of 4788 216 cmd.exe timeout.exe PID 216 wrote to memory of 4788 216 cmd.exe timeout.exe PID 216 wrote to memory of 4788 216 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\_____640.exe"C:\Users\Admin\AppData\Local\Temp\_____640.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\File.exe"C:\Users\Admin\AppData\Local\Temp\File.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\tmp.exe"C:\Users\Admin\AppData\Roaming\tmp.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 3604⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/File.exe" "%temp%\FolderN\name.exe" /Y3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier3⤵
- NTFS ADS
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/_____640.exe" "%temp%\FolderN\name.exe" /Y2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier2⤵
- NTFS ADS
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 3003⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3516 -ip 35161⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\File.exeFilesize
342KB
MD537c82e15058e2f8f5e9525b956e6440d
SHA13bf20d00bd7a7943c4066d534f5b276cac5ae39f
SHA25680c4716318f874881151c78c4dce9a0a01be4294834f33ee7f12a8a34bb8b2b7
SHA5125c9c37a13cac634771ae18736845b8e7c1a33fd8c6c9ae564f6863b5033a68565f0fd3da555d15870bbc547cc549153c096c44f2d7ced828baffdcfa8641da0a
-
C:\Users\Admin\AppData\Local\Temp\File.exeFilesize
342KB
MD537c82e15058e2f8f5e9525b956e6440d
SHA13bf20d00bd7a7943c4066d534f5b276cac5ae39f
SHA25680c4716318f874881151c78c4dce9a0a01be4294834f33ee7f12a8a34bb8b2b7
SHA5125c9c37a13cac634771ae18736845b8e7c1a33fd8c6c9ae564f6863b5033a68565f0fd3da555d15870bbc547cc549153c096c44f2d7ced828baffdcfa8641da0a
-
C:\Users\Admin\AppData\Local\Temp\FolderN\name.exeFilesize
342KB
MD537c82e15058e2f8f5e9525b956e6440d
SHA13bf20d00bd7a7943c4066d534f5b276cac5ae39f
SHA25680c4716318f874881151c78c4dce9a0a01be4294834f33ee7f12a8a34bb8b2b7
SHA5125c9c37a13cac634771ae18736845b8e7c1a33fd8c6c9ae564f6863b5033a68565f0fd3da555d15870bbc547cc549153c096c44f2d7ced828baffdcfa8641da0a
-
C:\Users\Admin\AppData\Local\Temp\FolderN\name.exeFilesize
342KB
MD537c82e15058e2f8f5e9525b956e6440d
SHA13bf20d00bd7a7943c4066d534f5b276cac5ae39f
SHA25680c4716318f874881151c78c4dce9a0a01be4294834f33ee7f12a8a34bb8b2b7
SHA5125c9c37a13cac634771ae18736845b8e7c1a33fd8c6c9ae564f6863b5033a68565f0fd3da555d15870bbc547cc549153c096c44f2d7ced828baffdcfa8641da0a
-
C:\Users\Admin\AppData\Local\Temp\FolderN\name.exeFilesize
342KB
MD537c82e15058e2f8f5e9525b956e6440d
SHA13bf20d00bd7a7943c4066d534f5b276cac5ae39f
SHA25680c4716318f874881151c78c4dce9a0a01be4294834f33ee7f12a8a34bb8b2b7
SHA5125c9c37a13cac634771ae18736845b8e7c1a33fd8c6c9ae564f6863b5033a68565f0fd3da555d15870bbc547cc549153c096c44f2d7ced828baffdcfa8641da0a
-
C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.batFilesize
204B
MD5bfcbf382f036462e63f307ca4ae280c7
SHA1ffe98d15fa5ea205220d6bc105e317253a6ea003
SHA2562c3dd84c3ce3e529117e611d8caf4fc7f5a902840350f4ca524c251a2152c727
SHA5121b912652cc989541b396df5fd6bf207a4cf4ed891dc6e3223b8d0497c19a2589cb644c4c96ca01d882a7643f240c566966d84e46d77e9ad33e05214f8f553d16
-
C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnkFilesize
1KB
MD55f5ca62c28136c67c2c113ad1181ae83
SHA1affc45957708539a05db9759a0af55e1951f457f
SHA2560805a531d212dfa83f6fc7943a2fc2247174fe8a9c5a71b6995eb4f8a088a4cf
SHA512228ddd26d89e919eef602f427764e93548bae8060605824fc1ddf66ab36f18bfa1ad14a4dd6ed06887998b253db819bfcb1a778a6c4926b66c5d7bb25e49b81f
-
C:\Users\Admin\AppData\Local\Temp\svhost.exeFilesize
256KB
MD58fdf47e0ff70c40ed3a17014aeea4232
SHA1e6256a0159688f0560b015da4d967f41cbf8c9bd
SHA256ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82
SHA512bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be
-
C:\Users\Admin\AppData\Local\Temp\svhost.exeFilesize
256KB
MD58fdf47e0ff70c40ed3a17014aeea4232
SHA1e6256a0159688f0560b015da4d967f41cbf8c9bd
SHA256ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82
SHA512bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be
-
C:\Users\Admin\AppData\Local\Temp\svhost.exeFilesize
256KB
MD58fdf47e0ff70c40ed3a17014aeea4232
SHA1e6256a0159688f0560b015da4d967f41cbf8c9bd
SHA256ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82
SHA512bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be
-
C:\Users\Admin\AppData\Roaming\tmp.exeFilesize
112KB
MD5bae2b04e1160950e570661f55d7cd6f8
SHA1f4abc073a091292547dda85d0ba044cab231c8da
SHA256ab0744c19af062c698e94e8eb9ee0e67bcf9a078f53d2a6a848406e2413c4d59
SHA5121bfef1217a6e2ecacee407eed70df9205cbfabb4ddfe06fcc11a7ddf2b42262ec3ab61421474b56b338fa76ffea9beac73530650d39eff61dffcfc25a7fe45b6
-
C:\Users\Admin\AppData\Roaming\tmp.exeFilesize
112KB
MD5bae2b04e1160950e570661f55d7cd6f8
SHA1f4abc073a091292547dda85d0ba044cab231c8da
SHA256ab0744c19af062c698e94e8eb9ee0e67bcf9a078f53d2a6a848406e2413c4d59
SHA5121bfef1217a6e2ecacee407eed70df9205cbfabb4ddfe06fcc11a7ddf2b42262ec3ab61421474b56b338fa76ffea9beac73530650d39eff61dffcfc25a7fe45b6
-
memory/216-166-0x0000000000000000-mapping.dmp
-
memory/376-167-0x0000000000000000-mapping.dmp
-
memory/1272-132-0x0000000000000000-mapping.dmp
-
memory/1272-135-0x0000000000290000-0x00000000002EC000-memory.dmpFilesize
368KB
-
memory/1288-141-0x0000000000000000-mapping.dmp
-
memory/1488-157-0x0000000000000000-mapping.dmp
-
memory/2132-145-0x0000000000000000-mapping.dmp
-
memory/2824-160-0x0000000000000000-mapping.dmp
-
memory/3516-153-0x0000000000570000-0x0000000000590000-memory.dmpFilesize
128KB
-
memory/3516-156-0x0000000000570000-0x0000000000590000-memory.dmpFilesize
128KB
-
memory/3516-151-0x0000000000570000-0x0000000000590000-memory.dmpFilesize
128KB
-
memory/3516-147-0x0000000000000000-mapping.dmp
-
memory/4104-163-0x0000000000000000-mapping.dmp
-
memory/4400-150-0x0000000000000000-mapping.dmp
-
memory/4748-162-0x0000000000000000-mapping.dmp
-
memory/4788-169-0x0000000000000000-mapping.dmp
-
memory/4832-130-0x0000000000240000-0x000000000032E000-memory.dmpFilesize
952KB
-
memory/4832-131-0x0000000004D80000-0x0000000004E1C000-memory.dmpFilesize
624KB
-
memory/5052-137-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/5052-146-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/5052-136-0x0000000000000000-mapping.dmp
-
memory/5052-140-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/5056-158-0x0000000000000000-mapping.dmp