Analysis
- max time kernel
1s - max time network
88s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
06/01/2024, 06:29
General
- Target 4586a5013e4fc086f2881d08648cd096.exe
- Size 3.1MB
- Sample240106-g9e35sbef4
- SHA256 0612fc8d387aad923a531b5692aa3dc4fc7284247918b30f513053a8bebdeaae
Malware Config
Extracted
-
netwire
-
174.127.99.159:7882
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
May-B
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Extracted
-
azorult
-
https://gemateknindoperkasa.co.id/imag/index.php
Signatures
- Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
- NetWire RAT payload 3 IoCs
- Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
- Executes dropped EXE 1 IoCs
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4586a5013e4fc086f2881d08648cd096.exe"C:\Users\Admin\AppData\Local\Temp\4586a5013e4fc086f2881d08648cd096.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c test.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\test.exetest.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\File.exe"C:\Users\Admin\AppData\Local\Temp\File.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\tmp.exe"C:\Users\Admin\AppData\Roaming\tmp.exe"5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 3646⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f5⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/File.exe" "%temp%\FolderN\name.exe" /Y5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/test.exe" "%temp%\FolderN\name.exe" /Y4⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier4⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"4⤵
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 864 -ip 8641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 904 -ip 9041⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 3161⤵
- Program crash
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
File.exe
File.exe
name.exe
name.exe.lnk
name.exe:Zone.Identifier
svhost.exe
svhost.exe
svhost.exe
test.exe
test.exe
tmp.exe
tmp.exe
tmp.exe
memory/864-33-0x0000000000610000-0x0000000000643000-memory.dmp
memory/864-29-0x0000000000610000-0x0000000000643000-memory.dmp
memory/864-39-0x0000000000610000-0x0000000000643000-memory.dmp
memory/904-57-0x0000000000560000-0x0000000000580000-memory.dmp
memory/904-52-0x0000000000560000-0x0000000000580000-memory.dmp
memory/904-54-0x0000000000560000-0x0000000000580000-memory.dmp
memory/2248-22-0x0000000074E70000-0x0000000075620000-memory.dmp
memory/2248-24-0x0000000004DA0000-0x0000000004DC4000-memory.dmp
memory/2248-21-0x00000000004F0000-0x000000000054C000-memory.dmp
memory/2248-23-0x0000000004DC0000-0x0000000004DD0000-memory.dmp
memory/2248-74-0x0000000074E70000-0x0000000075620000-memory.dmp
memory/2392-58-0x0000000000400000-0x0000000000420000-memory.dmp
memory/4328-0-0x0000000000400000-0x0000000000B9D000-memory.dmp
memory/4328-72-0x0000000000400000-0x0000000000B9D000-memory.dmp
memory/4328-69-0x0000000000400000-0x0000000000B9D000-memory.dmp
memory/4932-7-0x0000000005250000-0x00000000052EC000-memory.dmp
memory/4932-6-0x0000000074E70000-0x0000000075620000-memory.dmp
memory/4932-9-0x00000000051A0000-0x0000000005226000-memory.dmp
memory/4932-5-0x00000000006B0000-0x000000000079E000-memory.dmp
memory/4932-8-0x0000000005190000-0x00000000051A0000-memory.dmp
memory/4932-71-0x0000000074E70000-0x0000000075620000-memory.dmp