adwind | ce236d04aae0118265f73e1775a0ce05aa6357e0922905b2d08540f100c37ee5

Analysis

max time kernel
139s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2023, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sorrilus.exe
Size 10.3MB
Sample231202-e49z8ahg91
SHA256 314278fc36d4bf2c2051c64b5dd274c6254e51c8db45bb5174750839f63bab53
MD5 e4732ee9e8c0aa3276a51141b8b9b2d9
SHA1 3f5a763f1571551505fe89bdb2287b001a8ff009
SHA512 207c194c0d8554d84bbbecda4f06c746bdf3a77b3db0cab1717c029244d5f86a1357e9c3861f53e5e19f6b5d00d77c18cd923ef6d93b94eeb0128300872ae0a4
SSDEEP 196608:O2SvZ+chSsAhnS9+vFKWdfnP4L20N37Y2BqJMUrE6ed1g2ceCLTG1L09+Y7Ru:OlvZxBAA+vF55AL20UaeVy1pceCXEL09
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

adwind discovery trojan

Malware Config

Signatures

AdWind
A Java-based RAT family operated as malware-as-a-service.
trojan adwind

Class file contains resources related to AdWind 2 IoCs

resource	yara_rule
sample	family_adwind4
sample	family_adwind4

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000\Control Panel\International\Geo\Nation	sorrilus.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4300	icacls.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\symbols\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\symbols\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\dll\ntdll.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\server\jvm.pdb	javaw.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jvm.pdb	javaw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000_Classes\Local Settings	sorrilus.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2548	javaw.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 4924	4340	sorrilus.exe	89
PID 4340 wrote to memory of 4924	4340	sorrilus.exe	89
PID 4340 wrote to memory of 2548	4340	sorrilus.exe	90
PID 4340 wrote to memory of 2548	4340	sorrilus.exe	90
PID 4924 wrote to memory of 4300	4924	javaw.exe	91
PID 4924 wrote to memory of 4300	4924	javaw.exe	91

C:\Users\Admin\AppData\Local\Temp\sorrilus.exe
"C:\Users\Admin\AppData\Local\Temp\sorrilus.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\Sorillas-removedbackdoor.jar"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Windows\system32\icacls.exe
    C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
    3⤵
    - Modifies file permissions
    PID:4300
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\sorrilus.jar"
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 138ae466de6524a68861bdb5f964170d8d7f69aa9d1d49b5d9fd14cbcbe845a5
MD5 3b4d7e68cb2246c6d326b41651600404
SHA1 c5276bb88b3465ddb243bf52eaf4dbd1231ec96e
SHA512 e7a01c67820a28fe7b58fb3274cf8d9eebe4f00c564e2f856c347f9913769052608ac5005e59d318577d869450cc0a0ce5f10c23a9645dd60684ce8b50258e40
MD5 SHA1 SHA512

Submit Download

3903daac9bc4a3b7.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp
Size 46B
SHA256 138ae466de6524a68861bdb5f964170d8d7f69aa9d1d49b5d9fd14cbcbe845a5
MD5 3b4d7e68cb2246c6d326b41651600404
SHA1 c5276bb88b3465ddb243bf52eaf4dbd1231ec96e
SHA512 e7a01c67820a28fe7b58fb3274cf8d9eebe4f00c564e2f856c347f9913769052608ac5005e59d318577d869450cc0a0ce5f10c23a9645dd60684ce8b50258e40
MD5 SHA1 SHA512

Submit Download

Sorillas-removedbackdoor.jar

Path C:\Users\Admin\AppData\Local\Temp\Sorillas-removedbackdoor.jar
Size 10.0MB
SHA256 a3d0b59724e76cc3b4e4e132e0d344b679ae412b5e9c4faeb91bc33f45cbc5f6
MD5 e5b50a7c1da0dc7799b22699881a7bbb
SHA1 74a2dd531a7e45a09557e9b3459bf07e2f028aa3
SHA512 ae1c7d3b6e2470dfabb8883ea7fb3f6fe88e06308482e1c2f89bef0a353a8f73daea7e740b81be49d3915dc237c096598567e69555899d0ebc51847fe2fd53ac
SSDEEP 196608:qlloD+JydJIFFM0rT/mpDni/Mcd8qAbPeGmeIWvhAn9QrmU:qHop0FM02JiEQ/kGdeIWJC9Qrd
MD5 SHA1 SHA512 SSDEEP

Submit Download

sorrilus.jar

Path C:\Users\Admin\AppData\Local\Temp\sorrilus.jar
Size 639KB
SHA256 0bdc882b0cc311d814ac582592562f73a225701a474a023ceb8fa92a773fe5a2
MD5 09f5742b867972d346605e5f3da25e7a
SHA1 28ec50f0d3b1c357c5ffced62daa5d5552eb9cd1
SHA512 82997178ce8026eceae0833e04f1c61f863409111e351cbe6b65237bc8efb67bd8ff6bfdc1452597f540bd25a7a8b1df629a78b7fa43950b9c59d2c986f8a5c4
SSDEEP 12288:dbZ6QA/gSgPmP4jWEuVHgY/NRr+ZseN2BNg0VGR2/3Su42Z4S3XDI/:dbQQM8PO4y3HgY3uN2BSybSu1ZD3XDI/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2548-39-0x000001F41B490000-0x000001F41B491000-memory.dmp

Download

memory/2548-69-0x000001F41CDB0000-0x000001F41DDB0000-memory.dmp

Download

memory/2548-68-0x000001F41D030000-0x000001F41D040000-memory.dmp

Download

memory/2548-67-0x000001F41CDB0000-0x000001F41DDB0000-memory.dmp

Download

memory/2548-17-0x000001F41CDB0000-0x000001F41DDB0000-memory.dmp

Download

memory/2548-48-0x000001F41B490000-0x000001F41B491000-memory.dmp

Download

memory/4340-10-0x00007FFF29170000-0x00007FFF29C31000-memory.dmp

Download

memory/4340-1-0x00007FFF29170000-0x00007FFF29C31000-memory.dmp

Download

memory/4340-2-0x000000001BF70000-0x000000001BF80000-memory.dmp

Download

memory/4340-0-0x00000000006B0000-0x0000000001108000-memory.dmp

Download

memory/4924-40-0x0000016E00000000-0x0000016E01000000-memory.dmp

Download

memory/4924-45-0x0000016E7CA90000-0x0000016E7CA91000-memory.dmp

Download

memory/4924-38-0x0000016E7CA90000-0x0000016E7CA91000-memory.dmp

Download

memory/4924-51-0x0000016E7CA90000-0x0000016E7CA91000-memory.dmp

Download

memory/4924-52-0x0000016E7CA90000-0x0000016E7CA91000-memory.dmp

Download

memory/4924-58-0x0000016E7CA90000-0x0000016E7CA91000-memory.dmp

Download

memory/4924-62-0x0000016E7CA90000-0x0000016E7CA91000-memory.dmp

Download

memory/4924-60-0x0000016E7CA90000-0x0000016E7CA91000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads