azorult | cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67

Analysis

max time kernel
101s
max time network
136s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
25-07-2022 04:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe
Size

894KB
MD5

e4c6c1ca703d77b521ace023bee2df08
SHA1

61e97bd5a83c7b264af225d2b75eef4bd07d5b93
SHA256

cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67
SHA512

61007ce908055fe3f1e07d9ee9f7c40dd232f5de87b924552a5090622870a95d51e4c2b8e6312dd086c0bdeed668e40119c61dfc195d609595fa98652d67c705

Score

10^/10

azorult vidar 543 discovery infostealer persistence spyware stealer suricata trojan

Malware Config

Extracted

Family

vidar

Version

18.2

Botnet

543

http://barjamanis.com/

Attributes

profile_id
543

Extracted

Family

azorult

http://23.106.124.148/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata

Vidar Stealer 4 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/672-67-0x00000000004A0000-0x000000000052A000-memory.dmp	family_vidar
behavioral1/memory/672-68-0x0000000000400000-0x000000000049F000-memory.dmp	family_vidar
behavioral1/memory/672-79-0x0000000000400000-0x000000000049F000-memory.dmp	family_vidar
behavioral1/memory/672-82-0x0000000000400000-0x000000000049F000-memory.dmp	family_vidar

Executes dropped EXE 2 IoCs

Processes:

wotsuper.exewotsuper1.exe

pid process

672 wotsuper.exe
944 wotsuper1.exe

pid	process
672	wotsuper.exe
944	wotsuper1.exe

Loads dropped DLL 3 IoCs

Processes:

cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe

pid	process
1968	cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe
1968	cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe
1968	cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

regedit.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Run	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Run\Advanced SystemCare = "\"C:\\Program Files (x86)\\IObit\\Advanced SystemCare\\ASCTray.exe\" /Auto"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Run\wotsuper	regedit.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

42 ip-api.com

flow	ioc
42	ip-api.com

Drops file in Program Files directory 4 IoCs

Processes:

cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\Uninstall.exe	cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe
File created	C:\Program Files (x86)\wotsuper\wotsuper\Uninstall.ini	cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe	cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe	cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe

Drops file in Windows directory 1 IoCs

Processes:

cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe

description ioc process

File opened for modification C:\Windows\wotsuper.reg cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\wotsuper.reg	cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wotsuper.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wotsuper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wotsuper.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1212 taskkill.exe

pid	process
1212	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 59 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "365494755"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005fbcd10b409412459e4a784628514125000000000200000000001066000000010000200000007025a9012bf302b7a4be2ccb020d9cdd0054ff9e17a1d69f4575d2beb5df3376000000000e8000000002000020000000fecba8ab5e13910de24e9f2283db9a7ed9d40fce80af3ccd65ec036a7874381720000000f55dfa8b15f986b00d59ed135ffe669a5e6b5ebe75c7955918eee89b8bf2db66400000000c5079169346e2dc1caae6ad2829e584156fba24cdec364bbf7ea2746156c4527d9198a7d1da780d4753650aff7b805559acec6da338ba63c92e229b0c0db180	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40de0c26ee9fd801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4BB25941-0BE1-11ED-A495-62FF45EB19D5} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4BF814D1-0BE1-11ED-A495-62FF45EB19D5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005fbcd10b409412459e4a78462851412500000000020000000000106600000001000020000000b644b09398a8472481bd0d61e196d442af67a2a5c092538e7c6248036a889b3b000000000e80000000020000200000005af9e4cfb327427132d8afd7a4aa67c844402129b377a3e059920056bf6bfb1b9000000055a0c08d128aa48aa6b296022bb34eb2c7253a412fc00dc82829780b711822942a64f7f5919c7224180536076085b734f296fc52734d654c9efeb057e5ea2590e703262b65b2b75e2545c1eff8524ec83fde81a05f1eecca8bb259c3b009f9aada42f556f045939792b559aac8b483f0a7cecda2a6c1915f46fdd818268f03c08ecfd7213867ef3799c2464b7921dfb140000000b024fa6bc1583b324c765d893ba78a55895b7e7a2f42dd2b09ef65ca3ba66bbb944fc93a03f79a9eb2075b6635d039e093b73c5fedf9679257fb32dfda72589d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

1580 regedit.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

wotsuper.exe

pid process

672 wotsuper.exe
672 wotsuper.exe
672 wotsuper.exe
672 wotsuper.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 1212 taskkill.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

iexplore.exeiexplore.exe

pid process

896 iexplore.exe
1404 iexplore.exe

pid	process
1580	regedit.exe

pid	process
672	wotsuper.exe
672	wotsuper.exe
672	wotsuper.exe
672	wotsuper.exe

description	pid	process
Token: SeDebugPrivilege	1212	taskkill.exe

pid	process
896	iexplore.exe
1404	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXE

pid	process
1404	iexplore.exe
1404	iexplore.exe
896	iexplore.exe
896	iexplore.exe
468	IEXPLORE.EXE
468	IEXPLORE.EXE
1232	IEXPLORE.EXE
1232	IEXPLORE.EXE
468	IEXPLORE.EXE
468	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exeiexplore.exeiexplore.exewotsuper.execmd.exe

description	pid	process	target process
PID 1968 wrote to memory of 896	1968	cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe	iexplore.exe
PID 1968 wrote to memory of 896	1968	cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe	iexplore.exe
PID 1968 wrote to memory of 896	1968	cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe	iexplore.exe
PID 1968 wrote to memory of 896	1968	cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe	iexplore.exe
PID 1968 wrote to memory of 672	1968	cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe	wotsuper.exe
PID 1968 wrote to memory of 672	1968	cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe	wotsuper.exe
PID 1968 wrote to memory of 672	1968	cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe	wotsuper.exe
PID 1968 wrote to memory of 672	1968	cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe	wotsuper.exe
PID 1968 wrote to memory of 944	1968	cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe	wotsuper1.exe
PID 1968 wrote to memory of 944	1968	cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe	wotsuper1.exe
PID 1968 wrote to memory of 944	1968	cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe	wotsuper1.exe
PID 1968 wrote to memory of 944	1968	cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe	wotsuper1.exe
PID 1968 wrote to memory of 1580	1968	cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe	regedit.exe
PID 1968 wrote to memory of 1580	1968	cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe	regedit.exe
PID 1968 wrote to memory of 1580	1968	cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe	regedit.exe
PID 1968 wrote to memory of 1580	1968	cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe	regedit.exe
PID 1968 wrote to memory of 1404	1968	cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe	iexplore.exe
PID 1968 wrote to memory of 1404	1968	cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe	iexplore.exe
PID 1968 wrote to memory of 1404	1968	cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe	iexplore.exe
PID 1968 wrote to memory of 1404	1968	cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe	iexplore.exe
PID 1404 wrote to memory of 1232	1404	iexplore.exe	IEXPLORE.EXE
PID 1404 wrote to memory of 1232	1404	iexplore.exe	IEXPLORE.EXE
PID 1404 wrote to memory of 1232	1404	iexplore.exe	IEXPLORE.EXE
PID 1404 wrote to memory of 1232	1404	iexplore.exe	IEXPLORE.EXE
PID 896 wrote to memory of 468	896	iexplore.exe	IEXPLORE.EXE
PID 896 wrote to memory of 468	896	iexplore.exe	IEXPLORE.EXE
PID 896 wrote to memory of 468	896	iexplore.exe	IEXPLORE.EXE
PID 896 wrote to memory of 468	896	iexplore.exe	IEXPLORE.EXE
PID 672 wrote to memory of 1992	672	wotsuper.exe	cmd.exe
PID 672 wrote to memory of 1992	672	wotsuper.exe	cmd.exe
PID 672 wrote to memory of 1992	672	wotsuper.exe	cmd.exe
PID 672 wrote to memory of 1992	672	wotsuper.exe	cmd.exe
PID 1992 wrote to memory of 1212	1992	cmd.exe	taskkill.exe
PID 1992 wrote to memory of 1212	1992	cmd.exe	taskkill.exe
PID 1992 wrote to memory of 1212	1992	cmd.exe	taskkill.exe
PID 1992 wrote to memory of 1212	1992	cmd.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe
"C:\Users\Admin\AppData\Local\Temp\cbcd2fbfc1453a2df726c3801dd176bf06b92c59cd664b9298ea6746b35bfc67.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1968

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/1iB8r7.html
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:896

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:896 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:468

C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
"C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe"
2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:672

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im wotsuper.exe /f & erase C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe & exit
3⤵
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\SysWOW64\taskkill.exe
taskkill /im wotsuper.exe /f
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1212

C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe
"C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe"
2⤵
- Executes dropped EXE
PID:944

C:\Windows\SysWOW64\regedit.exe
"C:\Windows\System32\regedit.exe" \s C:\Windows\wotsuper.reg
2⤵
- Adds Run key to start application
- Runs .reg file with regedit
PID:1580

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/10f7w3.html
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1404

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1404 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1232

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
Filesize
557KB

MD5
bbb30f4967d6b28dc1f9ec475cfda6f3

SHA1
ced404f9e3a5e0c4882dde80bddac029966e7661

SHA256
34d88c992a7c5223e30c3805a5ae96bccd150267450428c7c4ca30b587622765

SHA512
0e78b75712c9f1562b49e9d423276c8ece3e8e1a46372146ec4c92ef1aaee68d6bcbfb332ade4113ba38e40645428846d51b9e641877d8fc7fe9962ebdccc7e7

Download Submit
C:\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe
Filesize
423KB

MD5
e37e62ee36bfe4dcec2239b22ad12c30

SHA1
7c60f0922966894ff872a5741affe1c7bc6ca179

SHA256
43213971e296853a951da06a4c58fd21a6b041833417707f0256f5129655cee2

SHA512
4e5aa53e88f2450e0740b782a1f466057ea46513032e873a5485cfcf39197967766b82cd8b59474ad9debcbca51b09b254d34711842eae3f5a527999782a1ff3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{4BB25941-0BE1-11ED-A495-62FF45EB19D5}.dat
Filesize
5KB

MD5
2f952ea8ef9d287e4f1f4cda7a836a76

SHA1
0df5251170f8a907f4b19094e9562bd309e70a73

SHA256
2a28f29123fcd31669fecd34c8b449a31a2e53c014f6355660c5f2abb99a2d5c

SHA512
a712268b42391ceb061e9959dfea08c9f8a4919e14074cbdf73e415f7388a316353ed80febfc8081053f3f10945b5cef0df1454974e36f631e5b941002ed090f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{4BF814D1-0BE1-11ED-A495-62FF45EB19D5}.dat
Filesize
3KB

MD5
a0ec1a9bc413137d04930be8609025b0

SHA1
6d801b81eeed8a6c7838e0a290aa8e9ad31bd05d

SHA256
74163a1dee731c6ef17cdeb3f6d0f1dd4f1d7ce148fe07f20cd6bd091f819416

SHA512
5bed0792d049bf8ff5db008e69cdd6b57e685a8d1097d5b1f05ca6a336a2a25d85d9fb9dffb6261056b858f9745d3c791873db584629577ac00b4a0c067a835b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\U724FHC7.txt
Filesize
599B

MD5
b5284120e1f38aae3541962376d99e12

SHA1
ec3e06fc30ba7425e911d341d259e4dbec962f2a

SHA256
6f90606cec31cd19b8ac6601a144f7fc98dcc9f20fdf47d141341717aa023533

SHA512
5a90cb3911fdd65b67b29d83425194e5592a9f2078c9a762e7421b0beefca3849f385cb540f14430a01a16ec3929add15ea6e2a3468bda3192bbfff9a9fe153d

Download Submit
C:\Windows\wotsuper.reg
Filesize
450B

MD5
42f073434559fb6b9c67aba86de89d1b

SHA1
9b969de41fc717353619068e46f21ec1db093ab5

SHA256
03ac69047bce954fdce3d00af881161a073f921d73ff79369e9ee96a109f9eed

SHA512
b1ae4fb02d7e629f824e084c5cd81e17be3bb37937eed7a1bfcd6aec0fd1cfe9a7299ecfc35958a5d98d11941fc6478e653b69140de02cbec28c4bf0647bd547

Download Submit
\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
Filesize
557KB

MD5
bbb30f4967d6b28dc1f9ec475cfda6f3

SHA1
ced404f9e3a5e0c4882dde80bddac029966e7661

SHA256
34d88c992a7c5223e30c3805a5ae96bccd150267450428c7c4ca30b587622765

SHA512
0e78b75712c9f1562b49e9d423276c8ece3e8e1a46372146ec4c92ef1aaee68d6bcbfb332ade4113ba38e40645428846d51b9e641877d8fc7fe9962ebdccc7e7

Download Submit
\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
Filesize
557KB

MD5
bbb30f4967d6b28dc1f9ec475cfda6f3

SHA1
ced404f9e3a5e0c4882dde80bddac029966e7661

SHA256
34d88c992a7c5223e30c3805a5ae96bccd150267450428c7c4ca30b587622765

SHA512
0e78b75712c9f1562b49e9d423276c8ece3e8e1a46372146ec4c92ef1aaee68d6bcbfb332ade4113ba38e40645428846d51b9e641877d8fc7fe9962ebdccc7e7

Download Submit
\Program Files (x86)\wotsuper\wotsuper\wotsuper1.exe
Filesize
423KB

MD5
e37e62ee36bfe4dcec2239b22ad12c30

SHA1
7c60f0922966894ff872a5741affe1c7bc6ca179

SHA256
43213971e296853a951da06a4c58fd21a6b041833417707f0256f5129655cee2

SHA512
4e5aa53e88f2450e0740b782a1f466057ea46513032e873a5485cfcf39197967766b82cd8b59474ad9debcbca51b09b254d34711842eae3f5a527999782a1ff3

Download Submit
memory/672-57-0x0000000000000000-mapping.dmp

Download
memory/672-77-0x000000000026B000-0x00000000002C2000-memory.dmp

Filesize
348KB

Download
memory/672-65-0x000000000026B000-0x00000000002C2000-memory.dmp

Filesize
348KB

Download
memory/672-67-0x00000000004A0000-0x000000000052A000-memory.dmp

Filesize
552KB

Download
memory/672-68-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/672-81-0x000000000026B000-0x00000000002C2000-memory.dmp

Filesize
348KB

Download
memory/672-82-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/672-79-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/944-66-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/944-78-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/944-76-0x0000000001EA0000-0x0000000001F8C000-memory.dmp

Filesize
944KB

Download
memory/944-71-0x0000000000310000-0x0000000000330000-memory.dmp

Filesize
128KB

Download
memory/944-60-0x0000000000000000-mapping.dmp

Download
memory/1212-83-0x0000000000000000-mapping.dmp

Download
memory/1580-62-0x0000000000000000-mapping.dmp

Download
memory/1968-54-0x0000000075851000-0x0000000075853000-memory.dmp

Filesize
8KB

Download
memory/1992-80-0x0000000000000000-mapping.dmp

Download