Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
13/09/2023, 15:36
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.Evo-gen.14221.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.Evo-gen.14221.exe
Resource
win10v2004-20230831-en
General
-
Target
SecuriteInfo.com.Win32.Evo-gen.14221.exe
-
Size
612KB
-
MD5
e8deb5283ad5d23b0837bdec68ba5fd3
-
SHA1
f6b2d51ae637fed40d14e101004150f558dcc7d2
-
SHA256
6b84c9e16c1ef41bbb3b00b48248cbf0745f0435a7e152cb8176900545d5c597
-
SHA512
9b6a3b0ea14c4877bc5135cfa304315e19bc043c3c84a3ca4eedd9df060fc5584e3766548d1294adb2e9a3c173a8103221e14bc1c9e1ae3ac22ce739c09d0f72
-
SSDEEP
6144:SgORa6xKTuuuqjL7IMLeSC3cwyOPhcn4H5Gx1+tp2MI4OFiDLBH73E55ag6WqRrJ:Sgm/SOhhcnj8mcBHLzg6WsrwuwHn2
Malware Config
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
description ioc Process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe SecuriteInfo.com.Win32.Evo-gen.14221.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe SecuriteInfo.com.Win32.Evo-gen.14221.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\Control Panel\International\Geo\Nation SecuriteInfo.com.Win32.Evo-gen.14221.exe -
Loads dropped DLL 12 IoCs
pid Process 1924 SecuriteInfo.com.Win32.Evo-gen.14221.exe 1924 SecuriteInfo.com.Win32.Evo-gen.14221.exe 1924 SecuriteInfo.com.Win32.Evo-gen.14221.exe 1924 SecuriteInfo.com.Win32.Evo-gen.14221.exe 1924 SecuriteInfo.com.Win32.Evo-gen.14221.exe 1924 SecuriteInfo.com.Win32.Evo-gen.14221.exe 1924 SecuriteInfo.com.Win32.Evo-gen.14221.exe 1924 SecuriteInfo.com.Win32.Evo-gen.14221.exe 4128 SecuriteInfo.com.Win32.Evo-gen.14221.exe 4128 SecuriteInfo.com.Win32.Evo-gen.14221.exe 4128 SecuriteInfo.com.Win32.Evo-gen.14221.exe 4128 SecuriteInfo.com.Win32.Evo-gen.14221.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook SecuriteInfo.com.Win32.Evo-gen.14221.exe Key opened \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook SecuriteInfo.com.Win32.Evo-gen.14221.exe Key opened \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook SecuriteInfo.com.Win32.Evo-gen.14221.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 4128 SecuriteInfo.com.Win32.Evo-gen.14221.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1924 SecuriteInfo.com.Win32.Evo-gen.14221.exe 4128 SecuriteInfo.com.Win32.Evo-gen.14221.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1924 set thread context of 4128 1924 SecuriteInfo.com.Win32.Evo-gen.14221.exe 96 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\resources\0409\eviler.sst SecuriteInfo.com.Win32.Evo-gen.14221.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SecuriteInfo.com.Win32.Evo-gen.14221.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SecuriteInfo.com.Win32.Evo-gen.14221.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 220 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4128 SecuriteInfo.com.Win32.Evo-gen.14221.exe 4128 SecuriteInfo.com.Win32.Evo-gen.14221.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1924 SecuriteInfo.com.Win32.Evo-gen.14221.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1924 wrote to memory of 4128 1924 SecuriteInfo.com.Win32.Evo-gen.14221.exe 96 PID 1924 wrote to memory of 4128 1924 SecuriteInfo.com.Win32.Evo-gen.14221.exe 96 PID 1924 wrote to memory of 4128 1924 SecuriteInfo.com.Win32.Evo-gen.14221.exe 96 PID 1924 wrote to memory of 4128 1924 SecuriteInfo.com.Win32.Evo-gen.14221.exe 96 PID 1924 wrote to memory of 4128 1924 SecuriteInfo.com.Win32.Evo-gen.14221.exe 96 PID 4128 wrote to memory of 4396 4128 SecuriteInfo.com.Win32.Evo-gen.14221.exe 98 PID 4128 wrote to memory of 4396 4128 SecuriteInfo.com.Win32.Evo-gen.14221.exe 98 PID 4128 wrote to memory of 4396 4128 SecuriteInfo.com.Win32.Evo-gen.14221.exe 98 PID 4396 wrote to memory of 220 4396 cmd.exe 100 PID 4396 wrote to memory of 220 4396 cmd.exe 100 PID 4396 wrote to memory of 220 4396 cmd.exe 100 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook SecuriteInfo.com.Win32.Evo-gen.14221.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1859779917-101786662-3680946609-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook SecuriteInfo.com.Win32.Evo-gen.14221.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.14221.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.14221.exe"1⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.14221.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.14221.exe"2⤵
- Checks QEMU agent file
- Checks computer location settings
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:4128 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "SecuriteInfo.com.Win32.Evo-gen.14221.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 34⤵
- Delays execution with timeout.exe
PID:220
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD59e682f1eb98a9d41468fc3e50f907635
SHA185e0ceca36f657ddf6547aa0744f0855a27527ee
SHA256830533bb569594ec2f7c07896b90225006b90a9af108f49d6fb6bebd02428b2d
SHA512230230722d61ac1089fabf3f2decfa04f9296498f8e2a2a49b1527797dca67b5a11ab8656f04087acadf873fa8976400d57c77c404eba4aff89d92b9986f32ed
-
Filesize
429KB
MD5109f0f02fd37c84bfc7508d4227d7ed5
SHA1ef7420141bb15ac334d3964082361a460bfdb975
SHA256334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
SHA51246eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39
-
Filesize
1.2MB
MD5556ea09421a0f74d31c4c0a89a70dc23
SHA1f739ba9b548ee64b13eb434a3130406d23f836e3
SHA256f0e6210d4a0d48c7908d8d1c270449c91eb4523e312a61256833bfeaf699abfb
SHA5122481fc80dffa8922569552c3c3ebaef8d0341b80427447a14b291ec39ea62ab9c05a75e85eef5ea7f857488cab1463c18586f9b076e2958c5a314e459045ede2
-
Filesize
81KB
MD57587bf9cb4147022cd5681b015183046
SHA1f2106306a8f6f0da5afb7fc765cfa0757ad5a628
SHA256c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
SHA5120b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f
-
Filesize
12KB
MD56e55a6e7c3fdbd244042eb15cb1ec739
SHA1070ea80e2192abc42f358d47b276990b5fa285a9
SHA256acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
SHA5122d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
-
Filesize
12KB
MD56e55a6e7c3fdbd244042eb15cb1ec739
SHA1070ea80e2192abc42f358d47b276990b5fa285a9
SHA256acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
SHA5122d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
-
Filesize
12KB
MD56e55a6e7c3fdbd244042eb15cb1ec739
SHA1070ea80e2192abc42f358d47b276990b5fa285a9
SHA256acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
SHA5122d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
-
Filesize
7KB
MD5ec9c99216ef11cdd85965e78bc797d2c
SHA11d5f93fbf4f8aab8164b109e9e1768e7b80ad88c
SHA256c1b7c3ef8b77a5bb335dc9ec9c3546b249014dde43aa2a9ed719b4d5933741df
SHA51235ff522c4efb3875fce0d6dce438f5225e5f27b414e7c16df88031e90b528c057fe10b4bbf755445c0500c3521e0797f562690aa7209f588169164bbfaceaba1
-
Filesize
7KB
MD5ec9c99216ef11cdd85965e78bc797d2c
SHA11d5f93fbf4f8aab8164b109e9e1768e7b80ad88c
SHA256c1b7c3ef8b77a5bb335dc9ec9c3546b249014dde43aa2a9ed719b4d5933741df
SHA51235ff522c4efb3875fce0d6dce438f5225e5f27b414e7c16df88031e90b528c057fe10b4bbf755445c0500c3521e0797f562690aa7209f588169164bbfaceaba1
-
Filesize
7KB
MD5ec9c99216ef11cdd85965e78bc797d2c
SHA11d5f93fbf4f8aab8164b109e9e1768e7b80ad88c
SHA256c1b7c3ef8b77a5bb335dc9ec9c3546b249014dde43aa2a9ed719b4d5933741df
SHA51235ff522c4efb3875fce0d6dce438f5225e5f27b414e7c16df88031e90b528c057fe10b4bbf755445c0500c3521e0797f562690aa7209f588169164bbfaceaba1
-
Filesize
7KB
MD5ec9c99216ef11cdd85965e78bc797d2c
SHA11d5f93fbf4f8aab8164b109e9e1768e7b80ad88c
SHA256c1b7c3ef8b77a5bb335dc9ec9c3546b249014dde43aa2a9ed719b4d5933741df
SHA51235ff522c4efb3875fce0d6dce438f5225e5f27b414e7c16df88031e90b528c057fe10b4bbf755445c0500c3521e0797f562690aa7209f588169164bbfaceaba1
-
Filesize
7KB
MD5ec9c99216ef11cdd85965e78bc797d2c
SHA11d5f93fbf4f8aab8164b109e9e1768e7b80ad88c
SHA256c1b7c3ef8b77a5bb335dc9ec9c3546b249014dde43aa2a9ed719b4d5933741df
SHA51235ff522c4efb3875fce0d6dce438f5225e5f27b414e7c16df88031e90b528c057fe10b4bbf755445c0500c3521e0797f562690aa7209f588169164bbfaceaba1
-
Filesize
7KB
MD5ec9c99216ef11cdd85965e78bc797d2c
SHA11d5f93fbf4f8aab8164b109e9e1768e7b80ad88c
SHA256c1b7c3ef8b77a5bb335dc9ec9c3546b249014dde43aa2a9ed719b4d5933741df
SHA51235ff522c4efb3875fce0d6dce438f5225e5f27b414e7c16df88031e90b528c057fe10b4bbf755445c0500c3521e0797f562690aa7209f588169164bbfaceaba1
-
Filesize
7KB
MD5ec9c99216ef11cdd85965e78bc797d2c
SHA11d5f93fbf4f8aab8164b109e9e1768e7b80ad88c
SHA256c1b7c3ef8b77a5bb335dc9ec9c3546b249014dde43aa2a9ed719b4d5933741df
SHA51235ff522c4efb3875fce0d6dce438f5225e5f27b414e7c16df88031e90b528c057fe10b4bbf755445c0500c3521e0797f562690aa7209f588169164bbfaceaba1