Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 00:34
Behavioral task
behavioral1
Sample
734527aaf04fdf03ec81f8886e4f1b66.exe
Resource
win7-20231129-en
General
-
Target
734527aaf04fdf03ec81f8886e4f1b66.exe
-
Size
3.1MB
-
MD5
734527aaf04fdf03ec81f8886e4f1b66
-
SHA1
8c2180f02b9494dbff83edf5e4b0e0cffabccb96
-
SHA256
7d120e6aad230faf1811a9ad8876a124ae27fcafa97ddff4c1a3e7b7a19e5a03
-
SHA512
ba8d192965a89fd3319e0ed09bdee74876aea67c8d89c8370349bf79520ed84030a557b4c76f6c27091ee4c4136dcf69a4d3851aa52b18ad7318b37c637519a8
-
SSDEEP
98304:zdNIA2b8lIpIta0Icq+KPtYulORjiCSHwdlPtqM7RcS4FIKU21IEfrNdSf8x:zdNB4ianUstYuUR2CSHsVP8x
Malware Config
Extracted
netwire
174.127.99.159:7882
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
May-B
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Extracted
azorult
https://gemateknindoperkasa.co.id/imag/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
NetWire RAT payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/8-27-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/8-30-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/8-32-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
test.exeFile.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation test.exe Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation File.exe -
Executes dropped EXE 5 IoCs
Processes:
test.exeFile.exesvhost.exetmp.exesvhost.exepid process 4704 test.exe 2832 File.exe 8 svhost.exe 2960 tmp.exe 4304 svhost.exe -
Processes:
resource yara_rule behavioral2/memory/1840-0-0x0000000000400000-0x0000000000B9D000-memory.dmp upx behavioral2/memory/1840-59-0x0000000000400000-0x0000000000B9D000-memory.dmp upx behavioral2/memory/1840-65-0x0000000000400000-0x0000000000B9D000-memory.dmp upx -
Suspicious use of SetThreadContext 2 IoCs
Processes:
test.exeFile.exedescription pid process target process PID 4704 set thread context of 8 4704 test.exe svhost.exe PID 2832 set thread context of 4304 2832 File.exe svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NTFS ADS 2 IoCs
Processes:
cmd.execmd.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier cmd.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier cmd.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
test.exeFile.exepid process 4704 test.exe 2832 File.exe 4704 test.exe 2832 File.exe 2832 File.exe 4704 test.exe 2832 File.exe 4704 test.exe 2832 File.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
test.exeFile.exedescription pid process Token: SeDebugPrivilege 4704 test.exe Token: SeDebugPrivilege 2832 File.exe -
Suspicious use of WriteProcessMemory 56 IoCs
Processes:
734527aaf04fdf03ec81f8886e4f1b66.execmd.exetest.exeFile.execmd.execmd.exedescription pid process target process PID 1840 wrote to memory of 4056 1840 734527aaf04fdf03ec81f8886e4f1b66.exe cmd.exe PID 1840 wrote to memory of 4056 1840 734527aaf04fdf03ec81f8886e4f1b66.exe cmd.exe PID 1840 wrote to memory of 4056 1840 734527aaf04fdf03ec81f8886e4f1b66.exe cmd.exe PID 4056 wrote to memory of 4704 4056 cmd.exe test.exe PID 4056 wrote to memory of 4704 4056 cmd.exe test.exe PID 4056 wrote to memory of 4704 4056 cmd.exe test.exe PID 4704 wrote to memory of 2832 4704 test.exe File.exe PID 4704 wrote to memory of 2832 4704 test.exe File.exe PID 4704 wrote to memory of 2832 4704 test.exe File.exe PID 4704 wrote to memory of 8 4704 test.exe svhost.exe PID 4704 wrote to memory of 8 4704 test.exe svhost.exe PID 4704 wrote to memory of 8 4704 test.exe svhost.exe PID 4704 wrote to memory of 8 4704 test.exe svhost.exe PID 4704 wrote to memory of 8 4704 test.exe svhost.exe PID 4704 wrote to memory of 8 4704 test.exe svhost.exe PID 4704 wrote to memory of 8 4704 test.exe svhost.exe PID 4704 wrote to memory of 8 4704 test.exe svhost.exe PID 4704 wrote to memory of 8 4704 test.exe svhost.exe PID 4704 wrote to memory of 8 4704 test.exe svhost.exe PID 4704 wrote to memory of 8 4704 test.exe svhost.exe PID 2832 wrote to memory of 2960 2832 File.exe tmp.exe PID 2832 wrote to memory of 2960 2832 File.exe tmp.exe PID 2832 wrote to memory of 2960 2832 File.exe tmp.exe PID 4704 wrote to memory of 4812 4704 test.exe cmd.exe PID 4704 wrote to memory of 4812 4704 test.exe cmd.exe PID 4704 wrote to memory of 4812 4704 test.exe cmd.exe PID 2832 wrote to memory of 4304 2832 File.exe svhost.exe PID 2832 wrote to memory of 4304 2832 File.exe svhost.exe PID 2832 wrote to memory of 4304 2832 File.exe svhost.exe PID 2832 wrote to memory of 4304 2832 File.exe svhost.exe PID 2832 wrote to memory of 4304 2832 File.exe svhost.exe PID 2832 wrote to memory of 4304 2832 File.exe svhost.exe PID 2832 wrote to memory of 4304 2832 File.exe svhost.exe PID 2832 wrote to memory of 4304 2832 File.exe svhost.exe PID 2832 wrote to memory of 4304 2832 File.exe svhost.exe PID 4704 wrote to memory of 4540 4704 test.exe cmd.exe PID 4704 wrote to memory of 4540 4704 test.exe cmd.exe PID 4704 wrote to memory of 4540 4704 test.exe cmd.exe PID 4540 wrote to memory of 4732 4540 cmd.exe reg.exe PID 4540 wrote to memory of 4732 4540 cmd.exe reg.exe PID 4540 wrote to memory of 4732 4540 cmd.exe reg.exe PID 2832 wrote to memory of 4508 2832 File.exe cmd.exe PID 2832 wrote to memory of 4508 2832 File.exe cmd.exe PID 2832 wrote to memory of 4508 2832 File.exe cmd.exe PID 4704 wrote to memory of 3912 4704 test.exe cmd.exe PID 4704 wrote to memory of 3912 4704 test.exe cmd.exe PID 4704 wrote to memory of 3912 4704 test.exe cmd.exe PID 2832 wrote to memory of 3752 2832 File.exe cmd.exe PID 2832 wrote to memory of 3752 2832 File.exe cmd.exe PID 2832 wrote to memory of 3752 2832 File.exe cmd.exe PID 3752 wrote to memory of 4312 3752 cmd.exe reg.exe PID 3752 wrote to memory of 4312 3752 cmd.exe reg.exe PID 3752 wrote to memory of 4312 3752 cmd.exe reg.exe PID 2832 wrote to memory of 1912 2832 File.exe cmd.exe PID 2832 wrote to memory of 1912 2832 File.exe cmd.exe PID 2832 wrote to memory of 1912 2832 File.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\734527aaf04fdf03ec81f8886e4f1b66.exe"C:\Users\Admin\AppData\Local\Temp\734527aaf04fdf03ec81f8886e4f1b66.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c test.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\test.exetest.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\File.exe"C:\Users\Admin\AppData\Local\Temp\File.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Roaming\tmp.exe"C:\Users\Admin\AppData\Roaming\tmp.exe"5⤵
- Executes dropped EXE
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"5⤵
- Executes dropped EXE
PID:4304 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/File.exe" "%temp%\FolderN\name.exe" /Y5⤵PID:4508
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f5⤵
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f6⤵PID:4312
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier5⤵
- NTFS ADS
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"4⤵
- Executes dropped EXE
PID:8 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/test.exe" "%temp%\FolderN\name.exe" /Y4⤵PID:4812
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f4⤵
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f5⤵PID:4732
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier4⤵
- NTFS ADS
PID:3912
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
342KB
MD537c82e15058e2f8f5e9525b956e6440d
SHA13bf20d00bd7a7943c4066d534f5b276cac5ae39f
SHA25680c4716318f874881151c78c4dce9a0a01be4294834f33ee7f12a8a34bb8b2b7
SHA5125c9c37a13cac634771ae18736845b8e7c1a33fd8c6c9ae564f6863b5033a68565f0fd3da555d15870bbc547cc549153c096c44f2d7ced828baffdcfa8641da0a
-
Filesize
342KB
MD5c354ffb6eb35414946657b3474942bad
SHA1767f7f173a0d16ceb6effba496797ac494b62bcf
SHA256a207be227f3a9ff3228f3d1a120bfd6a7279b02ce8939ea30d5c784bec81564d
SHA5126c03e583f7a160bf6137019e1bb463b232724e7d5d46cff535585771b3c860a84ea4f74c5b9918c737c1a3f551815dca08440825cdd0cf3f55dee3caf2c27516
-
Filesize
1KB
MD5a75bc9e2f8805d76e488c7618f220fc4
SHA1fe36e3d25dd587f5e29d128dfbe686a80010dd0c
SHA256e90ac22e9464b420c3c9f39abac5a89a189b154f353a1f846b9a55b7a3b1cd3f
SHA51235b85f3a52c53cf7ad272c7b46ba2604242c7e25896283263307f59c3ab0090ce0929f40fe223b19fe7669b3114e03862d16c82a3afc49530b5e7eaf2a3f7ecd
-
Filesize
27B
MD5130a75a932a2fe57bfea6a65b88da8f6
SHA1b66d7530d150d45c0a390bb3c2cd4ca4fc404d1c
SHA256f2b79cae559d6772afc1c2ed9468988178f8b6833d5028a15dea73ce47d0196e
SHA5126cd147c6f3af95803b7b0898e97ec2ed374c1f56a487b50e3d22003a67cec26a6fa12a3920b1b5624bde156f9601469ae3c7b7354fa8cf37be76c84121767eed
-
Filesize
256KB
MD58fdf47e0ff70c40ed3a17014aeea4232
SHA1e6256a0159688f0560b015da4d967f41cbf8c9bd
SHA256ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82
SHA512bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be
-
Filesize
931KB
MD5836cda1d8a9718485cc9f9653530c2d9
SHA1fca85ff9aa624547d9a315962d82388c300edac1
SHA256d3793a581da66ef5840648574ce364846e7c68a559c0f5e49faf9e4892ecdc72
SHA51207ca078d79f622706d08a534f6b5e2c896152fb0d0e452781fa6be5dc90028fdf074b3b78acac438f2acf5b3f5522e70afb7db4551874a3083860213e2790481
-
Filesize
112KB
MD5bae2b04e1160950e570661f55d7cd6f8
SHA1f4abc073a091292547dda85d0ba044cab231c8da
SHA256ab0744c19af062c698e94e8eb9ee0e67bcf9a078f53d2a6a848406e2413c4d59
SHA5121bfef1217a6e2ecacee407eed70df9205cbfabb4ddfe06fcc11a7ddf2b42262ec3ab61421474b56b338fa76ffea9beac73530650d39eff61dffcfc25a7fe45b6