Analysis
-
max time kernel
1s -
max time network
88s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2023 20:20
Behavioral task
behavioral1
Sample
NEAS.82339da9b0d225ecf2186b1525f72840.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
NEAS.82339da9b0d225ecf2186b1525f72840.exe
Resource
win10v2004-20231130-en
General
-
Target
NEAS.82339da9b0d225ecf2186b1525f72840.exe
-
Size
2.0MB
-
MD5
82339da9b0d225ecf2186b1525f72840
-
SHA1
ce98cc9d4f8729575b4f0e5db0d42af8f7194d7c
-
SHA256
54dd63d606a496420149d173ea0bfb21ec5e6bafdded2f1bf25042ccf8ca3edb
-
SHA512
fa8b8894536c0fc6801046cda0f68822cfa268d649feca4cbbc11114e7a506b4a112570dd5642732e8f4fe67cd3047b684c6d36b5087423bd78b3f0027c7420d
-
SSDEEP
24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYr:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9YV
Malware Config
Extracted
azorult
http://0x21.in:8000/_az/
Extracted
quasar
1.3.0.0
EbayProfiles
5.8.88.191:443
sockartek.icu:443
QSR_MUTEX_0kBRNrRz5TDLEQouI0
-
encryption_key
MWhG6wsClMX8aJM2CVXT
-
install_name
winsock.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
win defender run
-
subdirectory
SubDir
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Quasar payload 10 IoCs
Processes:
resource yara_rule behavioral2/memory/868-29-0x0000000000170000-0x00000000001CE000-memory.dmp family_quasar C:\Users\Admin\AppData\Local\Temp\windef.exe family_quasar C:\Users\Admin\AppData\Local\Temp\windef.exe family_quasar C:\Users\Admin\AppData\Local\Temp\windef.exe family_quasar C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe family_quasar C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe family_quasar C:\Users\Admin\AppData\Local\Temp\windef.exe family_quasar C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe family_quasar C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe family_quasar C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe family_quasar -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
NEAS.82339da9b0d225ecf2186b1525f72840.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-423100829-2271632622-1028104103-1000\Control Panel\International\Geo\Nation NEAS.82339da9b0d225ecf2186b1525f72840.exe -
Executes dropped EXE 2 IoCs
Processes:
vnc.exewindef.exepid process 2916 vnc.exe 868 windef.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
NEAS.82339da9b0d225ecf2186b1525f72840.exedescription ioc process File opened (read-only) \??\g: NEAS.82339da9b0d225ecf2186b1525f72840.exe File opened (read-only) \??\k: NEAS.82339da9b0d225ecf2186b1525f72840.exe File opened (read-only) \??\l: NEAS.82339da9b0d225ecf2186b1525f72840.exe File opened (read-only) \??\z: NEAS.82339da9b0d225ecf2186b1525f72840.exe File opened (read-only) \??\b: NEAS.82339da9b0d225ecf2186b1525f72840.exe File opened (read-only) \??\e: NEAS.82339da9b0d225ecf2186b1525f72840.exe File opened (read-only) \??\i: NEAS.82339da9b0d225ecf2186b1525f72840.exe File opened (read-only) \??\r: NEAS.82339da9b0d225ecf2186b1525f72840.exe File opened (read-only) \??\t: NEAS.82339da9b0d225ecf2186b1525f72840.exe File opened (read-only) \??\x: NEAS.82339da9b0d225ecf2186b1525f72840.exe File opened (read-only) \??\h: NEAS.82339da9b0d225ecf2186b1525f72840.exe File opened (read-only) \??\m: NEAS.82339da9b0d225ecf2186b1525f72840.exe File opened (read-only) \??\n: NEAS.82339da9b0d225ecf2186b1525f72840.exe File opened (read-only) \??\o: NEAS.82339da9b0d225ecf2186b1525f72840.exe File opened (read-only) \??\w: NEAS.82339da9b0d225ecf2186b1525f72840.exe File opened (read-only) \??\u: NEAS.82339da9b0d225ecf2186b1525f72840.exe File opened (read-only) \??\v: NEAS.82339da9b0d225ecf2186b1525f72840.exe File opened (read-only) \??\y: NEAS.82339da9b0d225ecf2186b1525f72840.exe File opened (read-only) \??\a: NEAS.82339da9b0d225ecf2186b1525f72840.exe File opened (read-only) \??\j: NEAS.82339da9b0d225ecf2186b1525f72840.exe File opened (read-only) \??\p: NEAS.82339da9b0d225ecf2186b1525f72840.exe File opened (read-only) \??\q: NEAS.82339da9b0d225ecf2186b1525f72840.exe File opened (read-only) \??\s: NEAS.82339da9b0d225ecf2186b1525f72840.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 ip-api.com -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe autoit_exe C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe autoit_exe C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
NEAS.82339da9b0d225ecf2186b1525f72840.exedescription pid process target process PID 644 set thread context of 1640 644 NEAS.82339da9b0d225ecf2186b1525f72840.exe NEAS.82339da9b0d225ecf2186b1525f72840.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process 3684 2916 WerFault.exe 1416 2692 WerFault.exe vnc.exe -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 4904 schtasks.exe 856 schtasks.exe 3108 schtasks.exe 1928 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
NEAS.82339da9b0d225ecf2186b1525f72840.exepid process 644 NEAS.82339da9b0d225ecf2186b1525f72840.exe 644 NEAS.82339da9b0d225ecf2186b1525f72840.exe 644 NEAS.82339da9b0d225ecf2186b1525f72840.exe 644 NEAS.82339da9b0d225ecf2186b1525f72840.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
windef.exedescription pid process Token: SeDebugPrivilege 868 windef.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
NEAS.82339da9b0d225ecf2186b1525f72840.exevnc.exedescription pid process target process PID 644 wrote to memory of 2916 644 NEAS.82339da9b0d225ecf2186b1525f72840.exe vnc.exe PID 644 wrote to memory of 2916 644 NEAS.82339da9b0d225ecf2186b1525f72840.exe vnc.exe PID 644 wrote to memory of 2916 644 NEAS.82339da9b0d225ecf2186b1525f72840.exe vnc.exe PID 2916 wrote to memory of 4716 2916 vnc.exe svchost.exe PID 2916 wrote to memory of 4716 2916 vnc.exe svchost.exe PID 644 wrote to memory of 868 644 NEAS.82339da9b0d225ecf2186b1525f72840.exe windef.exe PID 644 wrote to memory of 868 644 NEAS.82339da9b0d225ecf2186b1525f72840.exe windef.exe PID 644 wrote to memory of 868 644 NEAS.82339da9b0d225ecf2186b1525f72840.exe windef.exe PID 2916 wrote to memory of 4716 2916 vnc.exe svchost.exe PID 644 wrote to memory of 1640 644 NEAS.82339da9b0d225ecf2186b1525f72840.exe NEAS.82339da9b0d225ecf2186b1525f72840.exe PID 644 wrote to memory of 1640 644 NEAS.82339da9b0d225ecf2186b1525f72840.exe NEAS.82339da9b0d225ecf2186b1525f72840.exe PID 644 wrote to memory of 1640 644 NEAS.82339da9b0d225ecf2186b1525f72840.exe NEAS.82339da9b0d225ecf2186b1525f72840.exe PID 644 wrote to memory of 1640 644 NEAS.82339da9b0d225ecf2186b1525f72840.exe NEAS.82339da9b0d225ecf2186b1525f72840.exe PID 644 wrote to memory of 1640 644 NEAS.82339da9b0d225ecf2186b1525f72840.exe NEAS.82339da9b0d225ecf2186b1525f72840.exe PID 644 wrote to memory of 1928 644 NEAS.82339da9b0d225ecf2186b1525f72840.exe schtasks.exe PID 644 wrote to memory of 1928 644 NEAS.82339da9b0d225ecf2186b1525f72840.exe schtasks.exe PID 644 wrote to memory of 1928 644 NEAS.82339da9b0d225ecf2186b1525f72840.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.82339da9b0d225ecf2186b1525f72840.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.82339da9b0d225ecf2186b1525f72840.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\NEAS.82339da9b0d225ecf2186b1525f72840.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.82339da9b0d225ecf2186b1525f72840.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2916 -ip 29161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 5481⤵
- Program crash
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k1⤵
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeC:\Users\Admin\btpanui\SystemPropertiesPerformance.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 5203⤵
- Program crash
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2692 -ip 26921⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\windef.exe.logFilesize
701B
MD55de8527438c860bfa3140dc420a03e52
SHA1235af682986b3292f20d8d71a8671353f5d6e16d
SHA256d9d92cd6e7a4507912965138b8d1eabb3f188f4dfcb61115ee99dc2c0fd43a92
SHA51277c3a774a2235c55ad520f1bf0c71fa3d3f0e7cf478a78e0d4dd6d253ee12a9859acc9ee822664467387788a2655a18373c8fcf08ea0d001549d3d4391b00bf8
-
C:\Users\Admin\AppData\Local\Temp\vnc.exeFilesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
C:\Users\Admin\AppData\Local\Temp\vnc.exeFilesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
C:\Users\Admin\AppData\Local\Temp\vnc.exeFilesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
C:\Users\Admin\AppData\Local\Temp\vnc.exeFilesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
C:\Users\Admin\AppData\Local\Temp\windef.exeFilesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\AppData\Local\Temp\windef.exeFilesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\AppData\Local\Temp\windef.exeFilesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\AppData\Local\Temp\windef.exeFilesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exeFilesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exeFilesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeFilesize
2.0MB
MD5bfc12ab500cea0f63d21d36f580e9719
SHA1314b6e6a0a52033e94c10dc8140b2871489bbd2a
SHA256d4750cc9d4f237e9f0794f0cd31308b10263ce80dfabf6903baa2177e0bee976
SHA512878a84b5333a12645e91400139a3a616e92f6c9711d9354213d2322fc55fe9b094c0f908063a22c3a6cb3c01e9a230492072a242edcc59f77f77fd24d4267230
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeFilesize
2.0MB
MD5bfc12ab500cea0f63d21d36f580e9719
SHA1314b6e6a0a52033e94c10dc8140b2871489bbd2a
SHA256d4750cc9d4f237e9f0794f0cd31308b10263ce80dfabf6903baa2177e0bee976
SHA512878a84b5333a12645e91400139a3a616e92f6c9711d9354213d2322fc55fe9b094c0f908063a22c3a6cb3c01e9a230492072a242edcc59f77f77fd24d4267230
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeFilesize
2.0MB
MD5bfc12ab500cea0f63d21d36f580e9719
SHA1314b6e6a0a52033e94c10dc8140b2871489bbd2a
SHA256d4750cc9d4f237e9f0794f0cd31308b10263ce80dfabf6903baa2177e0bee976
SHA512878a84b5333a12645e91400139a3a616e92f6c9711d9354213d2322fc55fe9b094c0f908063a22c3a6cb3c01e9a230492072a242edcc59f77f77fd24d4267230
-
memory/644-19-0x0000000003E00000-0x0000000003E01000-memory.dmpFilesize
4KB
-
memory/868-29-0x0000000000170000-0x00000000001CE000-memory.dmpFilesize
376KB
-
memory/868-63-0x0000000004D80000-0x0000000004D90000-memory.dmpFilesize
64KB
-
memory/868-36-0x0000000004B30000-0x0000000004B96000-memory.dmpFilesize
408KB
-
memory/868-30-0x0000000072D60000-0x0000000073510000-memory.dmpFilesize
7.7MB
-
memory/868-37-0x00000000050F0000-0x0000000005102000-memory.dmpFilesize
72KB
-
memory/868-35-0x0000000004D80000-0x0000000004D90000-memory.dmpFilesize
64KB
-
memory/868-34-0x0000000004A90000-0x0000000004B22000-memory.dmpFilesize
584KB
-
memory/868-33-0x0000000005170000-0x0000000005714000-memory.dmpFilesize
5.6MB
-
memory/868-71-0x0000000072D60000-0x0000000073510000-memory.dmpFilesize
7.7MB
-
memory/868-62-0x0000000072D60000-0x0000000073510000-memory.dmpFilesize
7.7MB
-
memory/1640-20-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1640-28-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1824-49-0x0000000004DD0000-0x0000000004DE0000-memory.dmpFilesize
64KB
-
memory/1824-61-0x0000000072D60000-0x0000000073510000-memory.dmpFilesize
7.7MB
-
memory/1824-48-0x0000000072D60000-0x0000000073510000-memory.dmpFilesize
7.7MB
-
memory/2800-50-0x00000000003D0000-0x00000000003F0000-memory.dmpFilesize
128KB
-
memory/2800-59-0x00000000003D0000-0x00000000003F0000-memory.dmpFilesize
128KB
-
memory/3668-72-0x0000000005220000-0x0000000005230000-memory.dmpFilesize
64KB
-
memory/3668-70-0x0000000072D60000-0x0000000073510000-memory.dmpFilesize
7.7MB
-
memory/3668-74-0x0000000006760000-0x000000000676A000-memory.dmpFilesize
40KB