Analysis
- max time kernel
0s - max time network
117s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
06/01/2024, 10:07
General
- Target 5c51bfd0e569b49ceef10e825f1e47b1.exe
- Size 3.1MB
- Sample240106-l5nlyadcbm
- SHA256 818e5223c8cf5189ae57b4f19becd4f8d5468662955fcb002b4bb1e51100023e
Malware Config
Extracted
-
netwire
-
174.127.99.159:7882
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
May-B
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Extracted
-
azorult
-
https://gemateknindoperkasa.co.id/imag/index.php
Signatures
- Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
- NetWire RAT payload 3 IoCs
- Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
- Executes dropped EXE 1 IoCs
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c51bfd0e569b49ceef10e825f1e47b1.exe"C:\Users\Admin\AppData\Local\Temp\5c51bfd0e569b49ceef10e825f1e47b1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c test.exe2⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\test.exetest.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\File.exe"C:\Users\Admin\AppData\Local\Temp\File.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier3⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f3⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/File.exe" "%temp%\FolderN\name.exe" /Y3⤵
-
-
C:\Users\Admin\AppData\Roaming\tmp.exe"C:\Users\Admin\AppData\Roaming\tmp.exe"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/test.exe" "%temp%\FolderN\name.exe" /Y2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"2⤵
-
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f1⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
test.exe
memory/220-48-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1152-24-0x00000000057F0000-0x0000000005814000-memory.dmp
memory/1152-62-0x0000000074910000-0x00000000750C0000-memory.dmp
memory/1152-67-0x0000000074910000-0x00000000750C0000-memory.dmp
memory/1152-21-0x0000000000F40000-0x0000000000F9C000-memory.dmp
memory/1152-23-0x0000000003420000-0x0000000003430000-memory.dmp
memory/1152-22-0x0000000074910000-0x00000000750C0000-memory.dmp
memory/3208-9-0x0000000004D00000-0x0000000004D86000-memory.dmp
memory/3208-64-0x0000000074910000-0x00000000750C0000-memory.dmp
memory/3208-7-0x0000000004BF0000-0x0000000004C8C000-memory.dmp
memory/3208-6-0x0000000074910000-0x00000000750C0000-memory.dmp
memory/3208-61-0x0000000004CF0000-0x0000000004D00000-memory.dmp
memory/3208-60-0x0000000074910000-0x00000000750C0000-memory.dmp
memory/3208-5-0x0000000000150000-0x000000000023E000-memory.dmp
memory/3208-8-0x0000000004CF0000-0x0000000004D00000-memory.dmp
memory/4032-59-0x0000000000400000-0x0000000000B9D000-memory.dmp
memory/4032-65-0x0000000000400000-0x0000000000B9D000-memory.dmp
memory/4032-0-0x0000000000400000-0x0000000000B9D000-memory.dmp
memory/4656-41-0x0000000000400000-0x0000000000420000-memory.dmp
memory/4656-44-0x0000000000400000-0x0000000000420000-memory.dmp
memory/4656-47-0x0000000000400000-0x0000000000420000-memory.dmp
memory/4972-30-0x0000000000400000-0x0000000000433000-memory.dmp
memory/4972-27-0x0000000000400000-0x0000000000433000-memory.dmp
memory/4972-36-0x0000000000400000-0x0000000000433000-memory.dmp