Analysis
-
max time kernel
25s -
max time network
73s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
08-01-2024 23:10
Static task
static1
Behavioral task
behavioral1
Sample
4cb2b6e2c86e81a6b2ddd2aca707e66a.exe
Resource
win7-20231215-en
General
-
Target
4cb2b6e2c86e81a6b2ddd2aca707e66a.exe
-
Size
696KB
-
MD5
4cb2b6e2c86e81a6b2ddd2aca707e66a
-
SHA1
f13428a8ea50c72c6a24bd552804ab7a11428ec1
-
SHA256
157e30e05a61154cbc5bb5e36dc43b33e500bd552f8a0624d3a02d9f1249665a
-
SHA512
156e0c11011753cf46fd4817888c56294ab001c98fc32613e70104d9fd900be874baa30ac3bf5c09e7140eaf336b06f06e85568c7c6a7de0617f06e270048ce7
-
SSDEEP
12288:PBSewDX45BRwe+paNLHwwowZfFeNXeDoxTAn9D22oDgylgIHbqx8:PBS0B+/aRHwwoXteE9An9yhDcI7qx8
Malware Config
Extracted
azorult
http://195.245.112.115/index.php
Extracted
oski
gordonhk.ac.ug
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Detect ZGRat V1 35 IoCs
Processes:
resource yara_rule behavioral2/memory/1488-10-0x00000000077E0000-0x000000000789F000-memory.dmp family_zgrat_v1 behavioral2/memory/1488-26-0x00000000077E0000-0x000000000789F000-memory.dmp family_zgrat_v1 behavioral2/memory/1488-42-0x00000000077E0000-0x000000000789F000-memory.dmp family_zgrat_v1 behavioral2/memory/1488-56-0x00000000077E0000-0x000000000789F000-memory.dmp family_zgrat_v1 behavioral2/memory/1488-72-0x00000000077E0000-0x000000000789F000-memory.dmp family_zgrat_v1 behavioral2/memory/1488-70-0x00000000077E0000-0x000000000789F000-memory.dmp family_zgrat_v1 behavioral2/memory/1488-68-0x00000000077E0000-0x000000000789F000-memory.dmp family_zgrat_v1 behavioral2/memory/1488-66-0x00000000077E0000-0x000000000789F000-memory.dmp family_zgrat_v1 behavioral2/memory/1488-64-0x00000000077E0000-0x000000000789F000-memory.dmp family_zgrat_v1 behavioral2/memory/1488-62-0x00000000077E0000-0x000000000789F000-memory.dmp family_zgrat_v1 behavioral2/memory/1488-60-0x00000000077E0000-0x000000000789F000-memory.dmp family_zgrat_v1 behavioral2/memory/1488-58-0x00000000077E0000-0x000000000789F000-memory.dmp family_zgrat_v1 behavioral2/memory/1488-54-0x00000000077E0000-0x000000000789F000-memory.dmp family_zgrat_v1 behavioral2/memory/1488-52-0x00000000077E0000-0x000000000789F000-memory.dmp family_zgrat_v1 behavioral2/memory/1488-50-0x00000000077E0000-0x000000000789F000-memory.dmp family_zgrat_v1 behavioral2/memory/1488-48-0x00000000077E0000-0x000000000789F000-memory.dmp family_zgrat_v1 behavioral2/memory/1488-46-0x00000000077E0000-0x000000000789F000-memory.dmp family_zgrat_v1 behavioral2/memory/1488-44-0x00000000077E0000-0x000000000789F000-memory.dmp family_zgrat_v1 behavioral2/memory/1488-40-0x00000000077E0000-0x000000000789F000-memory.dmp family_zgrat_v1 behavioral2/memory/1488-38-0x00000000077E0000-0x000000000789F000-memory.dmp family_zgrat_v1 behavioral2/memory/1488-36-0x00000000077E0000-0x000000000789F000-memory.dmp family_zgrat_v1 behavioral2/memory/1488-34-0x00000000077E0000-0x000000000789F000-memory.dmp family_zgrat_v1 behavioral2/memory/1488-32-0x00000000077E0000-0x000000000789F000-memory.dmp family_zgrat_v1 behavioral2/memory/1488-30-0x00000000077E0000-0x000000000789F000-memory.dmp family_zgrat_v1 behavioral2/memory/1488-28-0x00000000077E0000-0x000000000789F000-memory.dmp family_zgrat_v1 behavioral2/memory/1488-24-0x00000000077E0000-0x000000000789F000-memory.dmp family_zgrat_v1 behavioral2/memory/1488-22-0x00000000077E0000-0x000000000789F000-memory.dmp family_zgrat_v1 behavioral2/memory/1488-20-0x00000000077E0000-0x000000000789F000-memory.dmp family_zgrat_v1 behavioral2/memory/1488-18-0x00000000077E0000-0x000000000789F000-memory.dmp family_zgrat_v1 behavioral2/memory/1488-16-0x00000000077E0000-0x000000000789F000-memory.dmp family_zgrat_v1 behavioral2/memory/1488-14-0x00000000077E0000-0x000000000789F000-memory.dmp family_zgrat_v1 behavioral2/memory/1488-12-0x00000000077E0000-0x000000000789F000-memory.dmp family_zgrat_v1 behavioral2/memory/1488-9-0x00000000077E0000-0x000000000789F000-memory.dmp family_zgrat_v1 behavioral2/memory/1488-8-0x00000000077E0000-0x00000000078A4000-memory.dmp family_zgrat_v1 behavioral2/memory/4540-1982-0x0000000007290000-0x0000000007308000-memory.dmp family_zgrat_v1 -
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3820 5064 WerFault.exe Gqgistxtagnubptvmqtbtconsoleapp9.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
4cb2b6e2c86e81a6b2ddd2aca707e66a.exedescription pid process Token: SeDebugPrivilege 1488 4cb2b6e2c86e81a6b2ddd2aca707e66a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4cb2b6e2c86e81a6b2ddd2aca707e66a.exe"C:\Users\Admin\AppData\Local\Temp\4cb2b6e2c86e81a6b2ddd2aca707e66a.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\4cb2b6e2c86e81a6b2ddd2aca707e66a.exeC:\Users\Admin\AppData\Local\Temp\4cb2b6e2c86e81a6b2ddd2aca707e66a.exe2⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Eyyozukgtsxfcpfq.vbs"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Gqgistxtagnubptvmqtbtconsoleapp9.exe"C:\Users\Admin\AppData\Local\Temp\Gqgistxtagnubptvmqtbtconsoleapp9.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\Gqgistxtagnubptvmqtbtconsoleapp9.exeC:\Users\Admin\AppData\Local\Temp\Gqgistxtagnubptvmqtbtconsoleapp9.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 13003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5064 -ip 50641⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1488-3-0x0000000005770000-0x0000000005802000-memory.dmpFilesize
584KB
-
memory/1488-5-0x0000000005920000-0x000000000592A000-memory.dmpFilesize
40KB
-
memory/1488-4-0x0000000005940000-0x0000000005950000-memory.dmpFilesize
64KB
-
memory/1488-2-0x0000000005C80000-0x0000000006224000-memory.dmpFilesize
5.6MB
-
memory/1488-1-0x0000000074F30000-0x00000000756E0000-memory.dmpFilesize
7.7MB
-
memory/1488-0-0x0000000000CD0000-0x0000000000D84000-memory.dmpFilesize
720KB
-
memory/1488-6-0x0000000007270000-0x000000000731A000-memory.dmpFilesize
680KB
-
memory/1488-7-0x00000000073A0000-0x0000000007416000-memory.dmpFilesize
472KB
-
memory/1488-10-0x00000000077E0000-0x000000000789F000-memory.dmpFilesize
764KB
-
memory/1488-26-0x00000000077E0000-0x000000000789F000-memory.dmpFilesize
764KB
-
memory/1488-42-0x00000000077E0000-0x000000000789F000-memory.dmpFilesize
764KB
-
memory/1488-56-0x00000000077E0000-0x000000000789F000-memory.dmpFilesize
764KB
-
memory/1488-72-0x00000000077E0000-0x000000000789F000-memory.dmpFilesize
764KB
-
memory/1488-70-0x00000000077E0000-0x000000000789F000-memory.dmpFilesize
764KB
-
memory/1488-68-0x00000000077E0000-0x000000000789F000-memory.dmpFilesize
764KB
-
memory/1488-66-0x00000000077E0000-0x000000000789F000-memory.dmpFilesize
764KB
-
memory/1488-64-0x00000000077E0000-0x000000000789F000-memory.dmpFilesize
764KB
-
memory/1488-62-0x00000000077E0000-0x000000000789F000-memory.dmpFilesize
764KB
-
memory/1488-60-0x00000000077E0000-0x000000000789F000-memory.dmpFilesize
764KB
-
memory/1488-58-0x00000000077E0000-0x000000000789F000-memory.dmpFilesize
764KB
-
memory/1488-54-0x00000000077E0000-0x000000000789F000-memory.dmpFilesize
764KB
-
memory/1488-243-0x0000000074F30000-0x00000000756E0000-memory.dmpFilesize
7.7MB
-
memory/1488-52-0x00000000077E0000-0x000000000789F000-memory.dmpFilesize
764KB
-
memory/1488-50-0x00000000077E0000-0x000000000789F000-memory.dmpFilesize
764KB
-
memory/1488-48-0x00000000077E0000-0x000000000789F000-memory.dmpFilesize
764KB
-
memory/1488-46-0x00000000077E0000-0x000000000789F000-memory.dmpFilesize
764KB
-
memory/1488-44-0x00000000077E0000-0x000000000789F000-memory.dmpFilesize
764KB
-
memory/1488-40-0x00000000077E0000-0x000000000789F000-memory.dmpFilesize
764KB
-
memory/1488-38-0x00000000077E0000-0x000000000789F000-memory.dmpFilesize
764KB
-
memory/1488-36-0x00000000077E0000-0x000000000789F000-memory.dmpFilesize
764KB
-
memory/1488-34-0x00000000077E0000-0x000000000789F000-memory.dmpFilesize
764KB
-
memory/1488-32-0x00000000077E0000-0x000000000789F000-memory.dmpFilesize
764KB
-
memory/1488-30-0x00000000077E0000-0x000000000789F000-memory.dmpFilesize
764KB
-
memory/1488-28-0x00000000077E0000-0x000000000789F000-memory.dmpFilesize
764KB
-
memory/1488-24-0x00000000077E0000-0x000000000789F000-memory.dmpFilesize
764KB
-
memory/1488-22-0x00000000077E0000-0x000000000789F000-memory.dmpFilesize
764KB
-
memory/1488-20-0x00000000077E0000-0x000000000789F000-memory.dmpFilesize
764KB
-
memory/1488-18-0x00000000077E0000-0x000000000789F000-memory.dmpFilesize
764KB
-
memory/1488-16-0x00000000077E0000-0x000000000789F000-memory.dmpFilesize
764KB
-
memory/1488-14-0x00000000077E0000-0x000000000789F000-memory.dmpFilesize
764KB
-
memory/1488-12-0x00000000077E0000-0x000000000789F000-memory.dmpFilesize
764KB
-
memory/1488-9-0x00000000077E0000-0x000000000789F000-memory.dmpFilesize
764KB
-
memory/1488-8-0x00000000077E0000-0x00000000078A4000-memory.dmpFilesize
784KB
-
memory/1488-1321-0x0000000005940000-0x0000000005950000-memory.dmpFilesize
64KB
-
memory/1488-1963-0x00000000079C0000-0x00000000079DE000-memory.dmpFilesize
120KB
-
memory/1488-1973-0x0000000074F30000-0x00000000756E0000-memory.dmpFilesize
7.7MB
-
memory/4540-1977-0x00000000009C0000-0x0000000000A28000-memory.dmpFilesize
416KB
-
memory/4540-1979-0x0000000005590000-0x00000000055A0000-memory.dmpFilesize
64KB
-
memory/4540-1978-0x0000000073740000-0x0000000073EF0000-memory.dmpFilesize
7.7MB
-
memory/4540-1981-0x0000000006ED0000-0x0000000006F2E000-memory.dmpFilesize
376KB
-
memory/4540-1982-0x0000000007290000-0x0000000007308000-memory.dmpFilesize
480KB
-
memory/4540-2431-0x0000000073740000-0x0000000073EF0000-memory.dmpFilesize
7.7MB
-
memory/4540-3968-0x0000000005590000-0x00000000055A0000-memory.dmpFilesize
64KB
-
memory/4540-4364-0x0000000073740000-0x0000000073EF0000-memory.dmpFilesize
7.7MB
-
memory/4624-1974-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4624-1980-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/5064-4365-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/5064-4368-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB