Analysis
-
max time kernel
5s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
15-12-2023 03:57
Behavioral task
behavioral1
Sample
08c110a8bc7a1db1927dc61b31004092.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
08c110a8bc7a1db1927dc61b31004092.exe
Resource
win10v2004-20231130-en
General
-
Target
08c110a8bc7a1db1927dc61b31004092.exe
-
Size
2.0MB
-
MD5
08c110a8bc7a1db1927dc61b31004092
-
SHA1
ffcdc5eb36dfcf7e6ab37a8894e98a4606389041
-
SHA256
505c8655a2adb1ad0976147c6777a9220e38ea6f2ab72d0575c5ef5d3a7a3f83
-
SHA512
aef2e0fb3a68f9f20ea264841ada8435926e9b0159e8e6b5da9fa1809c8968fa6ef10b7de8b8bc2ae744b26226467c1838bacf0acacb528e6d02fafd3d185a95
-
SSDEEP
24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYc:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9Yq
Malware Config
Extracted
azorult
http://0x21.in:8000/_az/
Extracted
quasar
1.3.0.0
EbayProfiles
5.8.88.191:443
sockartek.icu:443
QSR_MUTEX_0kBRNrRz5TDLEQouI0
-
encryption_key
MWhG6wsClMX8aJM2CVXT
-
install_name
winsock.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
win defender run
-
subdirectory
SubDir
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Quasar payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\windef.exe family_quasar behavioral2/memory/5044-24-0x0000000000D10000-0x0000000000D6E000-memory.dmp family_quasar -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
08c110a8bc7a1db1927dc61b31004092.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-433534792-1200107535-3148087551-1000\Control Panel\International\Geo\Nation 08c110a8bc7a1db1927dc61b31004092.exe -
Executes dropped EXE 3 IoCs
Processes:
vnc.exewindef.exewinsock.exepid process 4456 vnc.exe 5044 windef.exe 548 winsock.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
08c110a8bc7a1db1927dc61b31004092.exedescription ioc process File opened (read-only) \??\j: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\v: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\a: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\h: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\l: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\t: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\e: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\g: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\k: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\m: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\n: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\o: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\q: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\r: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\s: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\y: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\b: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\i: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\p: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\u: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\w: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\x: 08c110a8bc7a1db1927dc61b31004092.exe File opened (read-only) \??\z: 08c110a8bc7a1db1927dc61b31004092.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 19 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
08c110a8bc7a1db1927dc61b31004092.exedescription pid process target process PID 4488 set thread context of 4184 4488 08c110a8bc7a1db1927dc61b31004092.exe 08c110a8bc7a1db1927dc61b31004092.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4084 4456 WerFault.exe vnc.exe 1936 548 WerFault.exe winsock.exe -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 4676 schtasks.exe 4808 schtasks.exe 2464 schtasks.exe 604 schtasks.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
08c110a8bc7a1db1927dc61b31004092.exepid process 4488 08c110a8bc7a1db1927dc61b31004092.exe 4488 08c110a8bc7a1db1927dc61b31004092.exe 4488 08c110a8bc7a1db1927dc61b31004092.exe 4488 08c110a8bc7a1db1927dc61b31004092.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
windef.exewinsock.exedescription pid process Token: SeDebugPrivilege 5044 windef.exe Token: SeDebugPrivilege 548 winsock.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
winsock.exepid process 548 winsock.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
08c110a8bc7a1db1927dc61b31004092.exevnc.exewindef.exewinsock.exedescription pid process target process PID 4488 wrote to memory of 4456 4488 08c110a8bc7a1db1927dc61b31004092.exe vnc.exe PID 4488 wrote to memory of 4456 4488 08c110a8bc7a1db1927dc61b31004092.exe vnc.exe PID 4488 wrote to memory of 4456 4488 08c110a8bc7a1db1927dc61b31004092.exe vnc.exe PID 4456 wrote to memory of 3988 4456 vnc.exe svchost.exe PID 4456 wrote to memory of 3988 4456 vnc.exe svchost.exe PID 4488 wrote to memory of 5044 4488 08c110a8bc7a1db1927dc61b31004092.exe windef.exe PID 4488 wrote to memory of 5044 4488 08c110a8bc7a1db1927dc61b31004092.exe windef.exe PID 4488 wrote to memory of 5044 4488 08c110a8bc7a1db1927dc61b31004092.exe windef.exe PID 4456 wrote to memory of 3988 4456 vnc.exe svchost.exe PID 4488 wrote to memory of 4184 4488 08c110a8bc7a1db1927dc61b31004092.exe 08c110a8bc7a1db1927dc61b31004092.exe PID 4488 wrote to memory of 4184 4488 08c110a8bc7a1db1927dc61b31004092.exe 08c110a8bc7a1db1927dc61b31004092.exe PID 4488 wrote to memory of 4184 4488 08c110a8bc7a1db1927dc61b31004092.exe 08c110a8bc7a1db1927dc61b31004092.exe PID 4488 wrote to memory of 4184 4488 08c110a8bc7a1db1927dc61b31004092.exe 08c110a8bc7a1db1927dc61b31004092.exe PID 4488 wrote to memory of 4184 4488 08c110a8bc7a1db1927dc61b31004092.exe 08c110a8bc7a1db1927dc61b31004092.exe PID 4488 wrote to memory of 2464 4488 08c110a8bc7a1db1927dc61b31004092.exe schtasks.exe PID 4488 wrote to memory of 2464 4488 08c110a8bc7a1db1927dc61b31004092.exe schtasks.exe PID 4488 wrote to memory of 2464 4488 08c110a8bc7a1db1927dc61b31004092.exe schtasks.exe PID 5044 wrote to memory of 604 5044 windef.exe schtasks.exe PID 5044 wrote to memory of 604 5044 windef.exe schtasks.exe PID 5044 wrote to memory of 604 5044 windef.exe schtasks.exe PID 5044 wrote to memory of 548 5044 windef.exe winsock.exe PID 5044 wrote to memory of 548 5044 windef.exe winsock.exe PID 5044 wrote to memory of 548 5044 windef.exe winsock.exe PID 548 wrote to memory of 4676 548 winsock.exe schtasks.exe PID 548 wrote to memory of 4676 548 winsock.exe schtasks.exe PID 548 wrote to memory of 4676 548 winsock.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\08c110a8bc7a1db1927dc61b31004092.exe"C:\Users\Admin\AppData\Local\Temp\08c110a8bc7a1db1927dc61b31004092.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 5483⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4Q9GSZt0gRZF.bat" "4⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"5⤵
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 10804⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\08c110a8bc7a1db1927dc61b31004092.exe"C:\Users\Admin\AppData\Local\Temp\08c110a8bc7a1db1927dc61b31004092.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4456 -ip 44561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 548 -ip 5481⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4Q9GSZt0gRZF.batFilesize
208B
MD5c0ff054cc735391f5a2271d6b4be655f
SHA11056fd75bbd911d84445a9824f2b366afd372db6
SHA25607968d6339dd8ff73a0620df02577c929e1e7150486e9cc4b6bb7ec92f648d02
SHA512e1e8fade117f1337a6d769e6d6f1a53b79be6fb68d9ebb3ded8fa1be3c775bddd37ed78cdca118bba523f0fa5934d197cf536509e8c4d2daefd63a13d87fc9a3
-
C:\Users\Admin\AppData\Local\Temp\vnc.exeFilesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
C:\Users\Admin\AppData\Local\Temp\windef.exeFilesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\AppData\Roaming\Logs\12-15-2023Filesize
224B
MD5770c2477b32383776f09044858f1df77
SHA14bf3411c6dd5e2801b89777379b5bd98083c94a7
SHA256d27c4ff101c1c3bd2827622d16ee0c280843f90426381fc61e84e20e4aec4338
SHA5128e762a0c2ab76fea03f08db49a36895bff5d8888767414f64f8ead6ad45e901c2e0943a754e6476973a75586ca1821214ec41f4349876b190e548923d1c2e2eb
-
memory/548-45-0x00000000731A0000-0x0000000073950000-memory.dmpFilesize
7.7MB
-
memory/548-56-0x00000000731A0000-0x0000000073950000-memory.dmpFilesize
7.7MB
-
memory/548-51-0x00000000059E0000-0x00000000059F0000-memory.dmpFilesize
64KB
-
memory/548-50-0x00000000731A0000-0x0000000073950000-memory.dmpFilesize
7.7MB
-
memory/548-49-0x0000000006EC0000-0x0000000006ECA000-memory.dmpFilesize
40KB
-
memory/548-47-0x00000000059E0000-0x00000000059F0000-memory.dmpFilesize
64KB
-
memory/3672-59-0x0000000005500000-0x0000000005510000-memory.dmpFilesize
64KB
-
memory/3672-58-0x00000000731A0000-0x0000000073950000-memory.dmpFilesize
7.7MB
-
memory/3672-62-0x00000000731A0000-0x0000000073950000-memory.dmpFilesize
7.7MB
-
memory/4184-30-0x00000000004F0000-0x0000000000510000-memory.dmpFilesize
128KB
-
memory/4184-20-0x00000000004F0000-0x0000000000510000-memory.dmpFilesize
128KB
-
memory/4488-19-0x00000000034D0000-0x00000000034D1000-memory.dmpFilesize
4KB
-
memory/5044-46-0x00000000731A0000-0x0000000073950000-memory.dmpFilesize
7.7MB
-
memory/5044-38-0x0000000006890000-0x00000000068CC000-memory.dmpFilesize
240KB
-
memory/5044-37-0x0000000005B90000-0x0000000005BA2000-memory.dmpFilesize
72KB
-
memory/5044-36-0x00000000056F0000-0x0000000005756000-memory.dmpFilesize
408KB
-
memory/5044-35-0x0000000005800000-0x0000000005810000-memory.dmpFilesize
64KB
-
memory/5044-32-0x0000000005650000-0x00000000056E2000-memory.dmpFilesize
584KB
-
memory/5044-31-0x0000000005C00000-0x00000000061A4000-memory.dmpFilesize
5.6MB
-
memory/5044-24-0x0000000000D10000-0x0000000000D6E000-memory.dmpFilesize
376KB
-
memory/5044-25-0x00000000731A0000-0x0000000073950000-memory.dmpFilesize
7.7MB