Analysis
- max time kernel
4s - max time network
99s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
06/01/2024, 10:30
General
- Target 629151c519ea438d8c8f1123eb71e751.exe
- Size 3.1MB
- Sample240106-mj478seacm
- SHA256 8b80621cf6ee6cfef0091af3fd0f2c39a92f0c4efe2d6ec9dc5986d519628d07
Malware Config
Extracted
-
netwire
-
174.127.99.159:7882
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
May-B
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Extracted
-
azorult
-
https://gemateknindoperkasa.co.id/imag/index.php
Signatures
- Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
- NetWire RAT payload 4 IoCs
- Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
- Executes dropped EXE 1 IoCs
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\629151c519ea438d8c8f1123eb71e751.exe"C:\Users\Admin\AppData\Local\Temp\629151c519ea438d8c8f1123eb71e751.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c test.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\test.exetest.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\File.exe"C:\Users\Admin\AppData\Local\Temp\File.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f5⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier5⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/File.exe" "%temp%\FolderN\name.exe" /Y5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"5⤵
-
-
C:\Users\Admin\AppData\Roaming\tmp.exe"C:\Users\Admin\AppData\Roaming\tmp.exe"5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier4⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/test.exe" "%temp%\FolderN\name.exe" /Y4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
File.exe
File.exe
File.exe
name.exe
name.exe
name.exe.lnk
svhost.exe
svhost.exe
svhost.exe
test.exe
test.exe
tmp.exe
tmp.exe
tmp.exe
memory/648-68-0x0000000000400000-0x0000000000B9D000-memory.dmp
memory/648-59-0x0000000000400000-0x0000000000B9D000-memory.dmp
memory/648-0-0x0000000000400000-0x0000000000B9D000-memory.dmp
memory/816-22-0x0000000074B40000-0x00000000752F0000-memory.dmp
memory/816-24-0x00000000015B0000-0x00000000015D4000-memory.dmp
memory/816-67-0x0000000074B40000-0x00000000752F0000-memory.dmp
memory/816-62-0x0000000074B40000-0x00000000752F0000-memory.dmp
memory/816-23-0x00000000015D0000-0x00000000015E0000-memory.dmp
memory/816-21-0x0000000000E40000-0x0000000000E9C000-memory.dmp
memory/1064-46-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1064-43-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1064-47-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1264-50-0x0000000000400000-0x0000000000420000-memory.dmp
memory/2132-5-0x0000000074B40000-0x00000000752F0000-memory.dmp
memory/2132-6-0x0000000000080000-0x000000000016E000-memory.dmp
memory/2132-7-0x0000000004B20000-0x0000000004BBC000-memory.dmp
memory/2132-9-0x0000000004C50000-0x0000000004CD6000-memory.dmp
memory/2132-8-0x0000000004E40000-0x0000000004E50000-memory.dmp
memory/2132-60-0x0000000074B40000-0x00000000752F0000-memory.dmp
memory/2132-61-0x0000000004E40000-0x0000000004E50000-memory.dmp
memory/2132-66-0x0000000074B40000-0x00000000752F0000-memory.dmp
memory/2180-27-0x0000000000400000-0x0000000000433000-memory.dmp
memory/2180-31-0x0000000000400000-0x0000000000433000-memory.dmp
memory/2180-30-0x0000000000400000-0x0000000000433000-memory.dmp
memory/2180-69-0x0000000000400000-0x0000000000433000-memory.dmp