Analysis
- max time kernel
0s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
06/01/2024, 10:30
General
- Target 629151c519ea438d8c8f1123eb71e751.exe
- Size 3.1MB
- Sample240106-mj2gcaeacj
- SHA256 8b80621cf6ee6cfef0091af3fd0f2c39a92f0c4efe2d6ec9dc5986d519628d07
Malware Config
Extracted
-
netwire
-
174.127.99.159:7882
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
May-B
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Extracted
-
azorult
-
https://gemateknindoperkasa.co.id/imag/index.php
Signatures
- Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
- NetWire RAT payload 3 IoCs
- Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
- Executes dropped EXE 1 IoCs
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\629151c519ea438d8c8f1123eb71e751.exe"C:\Users\Admin\AppData\Local\Temp\629151c519ea438d8c8f1123eb71e751.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c test.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\test.exetest.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\File.exe"C:\Users\Admin\AppData\Local\Temp\File.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/File.exe" "%temp%\FolderN\name.exe" /Y5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"5⤵
-
-
C:\Users\Admin\AppData\Roaming\tmp.exe"C:\Users\Admin\AppData\Roaming\tmp.exe"5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier4⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f4⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/test.exe" "%temp%\FolderN\name.exe" /Y4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"4⤵
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4056 -ip 40561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4056 -s 3601⤵
- Program crash
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f1⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/740-30-0x0000000000400000-0x0000000000433000-memory.dmp
memory/740-27-0x0000000000400000-0x0000000000433000-memory.dmp
memory/740-31-0x0000000000400000-0x0000000000433000-memory.dmp
memory/1396-7-0x00000000052A0000-0x000000000533C000-memory.dmp
memory/1396-6-0x0000000074600000-0x0000000074DB0000-memory.dmp
memory/1396-65-0x0000000074600000-0x0000000074DB0000-memory.dmp
memory/1396-63-0x0000000074600000-0x0000000074DB0000-memory.dmp
memory/1396-8-0x0000000005390000-0x00000000053A0000-memory.dmp
memory/1396-5-0x0000000000800000-0x00000000008EE000-memory.dmp
memory/1396-9-0x00000000053A0000-0x0000000005426000-memory.dmp
memory/1800-0-0x0000000000400000-0x0000000000B9D000-memory.dmp
memory/1800-66-0x0000000000400000-0x0000000000B9D000-memory.dmp
memory/1800-62-0x0000000000400000-0x0000000000B9D000-memory.dmp
memory/2000-51-0x0000000000400000-0x0000000000420000-memory.dmp
memory/4056-47-0x0000000000740000-0x0000000000760000-memory.dmp
memory/4056-45-0x0000000000740000-0x0000000000760000-memory.dmp
memory/4056-50-0x0000000000740000-0x0000000000760000-memory.dmp
memory/4964-21-0x00000000007F0000-0x000000000084C000-memory.dmp
memory/4964-22-0x0000000074600000-0x0000000074DB0000-memory.dmp
memory/4964-24-0x0000000005080000-0x00000000050A4000-memory.dmp
memory/4964-68-0x0000000074600000-0x0000000074DB0000-memory.dmp
memory/4964-23-0x0000000005290000-0x00000000052A0000-memory.dmp