Analysis
-
max time kernel
6s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
15-12-2023 03:32
Behavioral task
behavioral1
Sample
08c110a8bc7a1db1927dc61b31004092.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
08c110a8bc7a1db1927dc61b31004092.exe
Resource
win10v2004-20231130-en
General
-
Target
08c110a8bc7a1db1927dc61b31004092.exe
-
Size
2.0MB
-
MD5
08c110a8bc7a1db1927dc61b31004092
-
SHA1
ffcdc5eb36dfcf7e6ab37a8894e98a4606389041
-
SHA256
505c8655a2adb1ad0976147c6777a9220e38ea6f2ab72d0575c5ef5d3a7a3f83
-
SHA512
aef2e0fb3a68f9f20ea264841ada8435926e9b0159e8e6b5da9fa1809c8968fa6ef10b7de8b8bc2ae744b26226467c1838bacf0acacb528e6d02fafd3d185a95
-
SSDEEP
24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYc:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9Yq
Malware Config
Extracted
azorult
http://0x21.in:8000/_az/
Extracted
quasar
1.3.0.0
EbayProfiles
5.8.88.191:443
sockartek.icu:443
QSR_MUTEX_0kBRNrRz5TDLEQouI0
-
encryption_key
MWhG6wsClMX8aJM2CVXT
-
install_name
winsock.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
win defender run
-
subdirectory
SubDir
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Quasar payload 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\windef.exe family_quasar behavioral2/memory/2028-26-0x0000000000740000-0x000000000079E000-memory.dmp family_quasar C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe family_quasar -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
08c110a8bc7a1db1927dc61b31004092.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1791582586-1997866593-3795608343-1000\Control Panel\International\Geo\Nation 08c110a8bc7a1db1927dc61b31004092.exe -
Executes dropped EXE 3 IoCs
Processes:
vnc.exewindef.exewinsock.exepid process 3984 vnc.exe 2028 windef.exe 3572 winsock.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
08c110a8bc7a1db1927dc61b31004092.exedescription ioc process File opened (read-only) \??\r: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\t: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\v: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\b: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\g: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\j: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\n: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\o: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\y: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\z: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\k: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\l: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\m: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\p: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\w: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\e: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\s: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\x: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\a: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\h: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\i: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\q: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\u: 08c110a8bc7a1db1927dc61b31004092.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 10 ip-api.com -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
08c110a8bc7a1db1927dc61b31004092.exedescription pid process target process PID 4396 set thread context of 1900 4396 08c110a8bc7a1db1927dc61b31004092.exe 08c110a8bc7a1db1927dc61b31004092.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2528 3984 WerFault.exe vnc.exe 4760 3572 WerFault.exe winsock.exe 4400 3196 WerFault.exe vnc.exe -
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 3980 schtasks.exe 4324 schtasks.exe 3976 schtasks.exe 1192 schtasks.exe 4364 schtasks.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
08c110a8bc7a1db1927dc61b31004092.exepid process 4396 08c110a8bc7a1db1927dc61b31004092.exe 4396 08c110a8bc7a1db1927dc61b31004092.exe 4396 08c110a8bc7a1db1927dc61b31004092.exe 4396 08c110a8bc7a1db1927dc61b31004092.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
windef.exewinsock.exedescription pid process Token: SeDebugPrivilege 2028 windef.exe Token: SeDebugPrivilege 3572 winsock.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
winsock.exepid process 3572 winsock.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
08c110a8bc7a1db1927dc61b31004092.exevnc.exewindef.exewinsock.exedescription pid process target process PID 4396 wrote to memory of 3984 4396 08c110a8bc7a1db1927dc61b31004092.exe vnc.exe PID 4396 wrote to memory of 3984 4396 08c110a8bc7a1db1927dc61b31004092.exe vnc.exe PID 4396 wrote to memory of 3984 4396 08c110a8bc7a1db1927dc61b31004092.exe vnc.exe PID 3984 wrote to memory of 4612 3984 vnc.exe svchost.exe PID 3984 wrote to memory of 4612 3984 vnc.exe svchost.exe PID 3984 wrote to memory of 4612 3984 vnc.exe svchost.exe PID 4396 wrote to memory of 2028 4396 08c110a8bc7a1db1927dc61b31004092.exe windef.exe PID 4396 wrote to memory of 2028 4396 08c110a8bc7a1db1927dc61b31004092.exe windef.exe PID 4396 wrote to memory of 2028 4396 08c110a8bc7a1db1927dc61b31004092.exe windef.exe PID 4396 wrote to memory of 1900 4396 08c110a8bc7a1db1927dc61b31004092.exe 08c110a8bc7a1db1927dc61b31004092.exe PID 4396 wrote to memory of 1900 4396 08c110a8bc7a1db1927dc61b31004092.exe 08c110a8bc7a1db1927dc61b31004092.exe PID 4396 wrote to memory of 1900 4396 08c110a8bc7a1db1927dc61b31004092.exe 08c110a8bc7a1db1927dc61b31004092.exe PID 4396 wrote to memory of 1900 4396 08c110a8bc7a1db1927dc61b31004092.exe 08c110a8bc7a1db1927dc61b31004092.exe PID 4396 wrote to memory of 1900 4396 08c110a8bc7a1db1927dc61b31004092.exe 08c110a8bc7a1db1927dc61b31004092.exe PID 4396 wrote to memory of 3980 4396 08c110a8bc7a1db1927dc61b31004092.exe schtasks.exe PID 4396 wrote to memory of 3980 4396 08c110a8bc7a1db1927dc61b31004092.exe schtasks.exe PID 4396 wrote to memory of 3980 4396 08c110a8bc7a1db1927dc61b31004092.exe schtasks.exe PID 2028 wrote to memory of 4324 2028 windef.exe schtasks.exe PID 2028 wrote to memory of 4324 2028 windef.exe schtasks.exe PID 2028 wrote to memory of 4324 2028 windef.exe schtasks.exe PID 2028 wrote to memory of 3572 2028 windef.exe winsock.exe PID 2028 wrote to memory of 3572 2028 windef.exe winsock.exe PID 2028 wrote to memory of 3572 2028 windef.exe winsock.exe PID 3572 wrote to memory of 3976 3572 winsock.exe schtasks.exe PID 3572 wrote to memory of 3976 3572 winsock.exe schtasks.exe PID 3572 wrote to memory of 3976 3572 winsock.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08c110a8bc7a1db1927dc61b31004092.exe"C:\Users\Admin\AppData\Local\Temp\08c110a8bc7a1db1927dc61b31004092.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 5523⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5PjXWu5NrSqY.bat" "4⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"5⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3572 -s 16724⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\08c110a8bc7a1db1927dc61b31004092.exe"C:\Users\Admin\AppData\Local\Temp\08c110a8bc7a1db1927dc61b31004092.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3984 -ip 39841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3572 -ip 35721⤵
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeC:\Users\Admin\btpanui\SystemPropertiesPerformance.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 5203⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3196 -ip 31961⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\windef.exe.logFilesize
1KB
MD510eab9c2684febb5327b6976f2047587
SHA1a12ed54146a7f5c4c580416aecb899549712449e
SHA256f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928
SHA5127e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50
-
C:\Users\Admin\AppData\Local\Temp\5PjXWu5NrSqY.batFilesize
208B
MD5ec3c9203f0a80fbc53ea3e856deb82dd
SHA1914e768a2b149c8b54ca36bdc200cf62ba693fbc
SHA256c364f449003c56c1fdbb560a06a4e1774480e7b653c1ddbef8bac8744b3f39ad
SHA512238795143932a754c729198aa68ec3330205815cdceb9b9013a553c2b5ed4c542316d1855aa31291172b1a47dca38cbe115eb8d0b7247048a7c4dc3682dbb8ba
-
C:\Users\Admin\AppData\Local\Temp\vnc.exeFilesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
C:\Users\Admin\AppData\Local\Temp\windef.exeFilesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\AppData\Roaming\Logs\12-15-2023Filesize
224B
MD5bfa3520ef5b1219a887bdc65d7b26e25
SHA19454923dcd892d10ede96e6d750667ca3c95abd9
SHA25646a7b1bb6319008e80d6fc24ba8a27112fad07170cf2d8339eae771a7a4ec7d4
SHA512d43ede244e7314c60273b0d03ba572d514c4faafb6acf8310139c73aa82ff1aaf35b88d6fb3de317f5954eb69fd8268f7763ba9d3c9a2c237b7e6b9a8fb9c67d
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeFilesize
2.0MB
MD5252963934c201851e86114d17ce62bb3
SHA1239cc934a9cc6371270634922eebebdb0ee7adec
SHA256f2f2f1f0441e61ca0007915224ddb6e9c72995cdb14ccab717fbad85450d7cf5
SHA512da15cfd1dc8186080fdb0905a8445cce0b0e37229c34730d1d9832c0feb4300048a31eb019ea83281343a6549aadf82c991ae08d4c75cdb96883d67e4d0a07b2
-
memory/808-81-0x00000000736D0000-0x0000000073E80000-memory.dmpFilesize
7.7MB
-
memory/808-83-0x0000000004DA0000-0x0000000004DB0000-memory.dmpFilesize
64KB
-
memory/808-94-0x00000000736D0000-0x0000000073E80000-memory.dmpFilesize
7.7MB
-
memory/1900-19-0x0000000000390000-0x00000000003B0000-memory.dmpFilesize
128KB
-
memory/1900-31-0x0000000000390000-0x00000000003B0000-memory.dmpFilesize
128KB
-
memory/2028-28-0x00000000736D0000-0x0000000073E80000-memory.dmpFilesize
7.7MB
-
memory/2028-38-0x00000000062B0000-0x00000000062EC000-memory.dmpFilesize
240KB
-
memory/2028-45-0x00000000736D0000-0x0000000073E80000-memory.dmpFilesize
7.7MB
-
memory/2028-37-0x00000000055B0000-0x00000000055C2000-memory.dmpFilesize
72KB
-
memory/2028-36-0x00000000050A0000-0x0000000005106000-memory.dmpFilesize
408KB
-
memory/2028-35-0x0000000005120000-0x0000000005130000-memory.dmpFilesize
64KB
-
memory/2028-32-0x0000000005130000-0x00000000051C2000-memory.dmpFilesize
584KB
-
memory/2028-30-0x00000000055E0000-0x0000000005B84000-memory.dmpFilesize
5.6MB
-
memory/2028-26-0x0000000000740000-0x000000000079E000-memory.dmpFilesize
376KB
-
memory/2592-84-0x0000000000AB0000-0x0000000000AD0000-memory.dmpFilesize
128KB
-
memory/2592-93-0x0000000000AB0000-0x0000000000AD0000-memory.dmpFilesize
128KB
-
memory/3416-95-0x0000000003FE0000-0x0000000003FE1000-memory.dmpFilesize
4KB
-
memory/3572-46-0x00000000736D0000-0x0000000073E80000-memory.dmpFilesize
7.7MB
-
memory/3572-55-0x00000000736D0000-0x0000000073E80000-memory.dmpFilesize
7.7MB
-
memory/3572-50-0x00000000736D0000-0x0000000073E80000-memory.dmpFilesize
7.7MB
-
memory/3572-49-0x0000000006EC0000-0x0000000006ECA000-memory.dmpFilesize
40KB
-
memory/3572-47-0x0000000005890000-0x00000000058A0000-memory.dmpFilesize
64KB
-
memory/4396-20-0x0000000003950000-0x0000000003951000-memory.dmpFilesize
4KB
-
memory/4864-58-0x0000000005090000-0x00000000050A0000-memory.dmpFilesize
64KB
-
memory/4864-57-0x00000000736D0000-0x0000000073E80000-memory.dmpFilesize
7.7MB