Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
11/02/2024, 17:06
Behavioral task
behavioral1
Sample
AZGAIQ.exe
Resource
win7-20231215-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
AZGAIQ.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
AZGAIQ.exe
-
Size
1.3MB
-
MD5
0ec1335d66a4cc8ab5a5fb48a3560bc4
-
SHA1
f22ad2202454c56087ae0d2de4442a89bdea046e
-
SHA256
46db56c2197d24b0b8fa1588ea1ba0b91bed54afd2876c00b737593660c0c3cd
-
SHA512
6048d3c5bd3af1857b02cda2227cfb992cd6f55e7ceda41036d5661675e022c0a7a0daaf98db66227ac39bf06e3f62bb941915e84a0786956c63f6d6ba6a53b3
-
SSDEEP
24576:ethEVaPqL5uTGczYcXga6C7WrmjSD2IrKFhoV7u:mEVUc5uTGczjSA2DVrKURu
Score
9/10
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 15 IoCs
resource yara_rule behavioral1/memory/2560-0-0x0000000000400000-0x00000000004CA000-memory.dmp UPX behavioral1/memory/2560-181-0x0000000000400000-0x00000000004CA000-memory.dmp UPX behavioral1/memory/2560-190-0x0000000000400000-0x00000000004CA000-memory.dmp UPX behavioral1/memory/2560-199-0x0000000000400000-0x00000000004CA000-memory.dmp UPX behavioral1/memory/2560-210-0x0000000000400000-0x00000000004CA000-memory.dmp UPX behavioral1/memory/2560-218-0x0000000000400000-0x00000000004CA000-memory.dmp UPX behavioral1/memory/2560-228-0x0000000000400000-0x00000000004CA000-memory.dmp UPX behavioral1/memory/2560-237-0x0000000000400000-0x00000000004CA000-memory.dmp UPX behavioral1/memory/2560-248-0x0000000000400000-0x00000000004CA000-memory.dmp UPX behavioral1/memory/2560-257-0x0000000000400000-0x00000000004CA000-memory.dmp UPX behavioral1/memory/2560-266-0x0000000000400000-0x00000000004CA000-memory.dmp UPX behavioral1/memory/2560-276-0x0000000000400000-0x00000000004CA000-memory.dmp UPX behavioral1/memory/2560-285-0x0000000000400000-0x00000000004CA000-memory.dmp UPX behavioral1/memory/2560-294-0x0000000000400000-0x00000000004CA000-memory.dmp UPX behavioral1/memory/2560-303-0x0000000000400000-0x00000000004CA000-memory.dmp UPX -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/2560-0-0x0000000000400000-0x00000000004CA000-memory.dmp upx behavioral1/memory/2560-181-0x0000000000400000-0x00000000004CA000-memory.dmp upx behavioral1/memory/2560-190-0x0000000000400000-0x00000000004CA000-memory.dmp upx behavioral1/memory/2560-199-0x0000000000400000-0x00000000004CA000-memory.dmp upx behavioral1/memory/2560-210-0x0000000000400000-0x00000000004CA000-memory.dmp upx behavioral1/memory/2560-218-0x0000000000400000-0x00000000004CA000-memory.dmp upx behavioral1/memory/2560-228-0x0000000000400000-0x00000000004CA000-memory.dmp upx behavioral1/memory/2560-237-0x0000000000400000-0x00000000004CA000-memory.dmp upx behavioral1/memory/2560-248-0x0000000000400000-0x00000000004CA000-memory.dmp upx behavioral1/memory/2560-257-0x0000000000400000-0x00000000004CA000-memory.dmp upx behavioral1/memory/2560-266-0x0000000000400000-0x00000000004CA000-memory.dmp upx behavioral1/memory/2560-276-0x0000000000400000-0x00000000004CA000-memory.dmp upx behavioral1/memory/2560-285-0x0000000000400000-0x00000000004CA000-memory.dmp upx behavioral1/memory/2560-294-0x0000000000400000-0x00000000004CA000-memory.dmp upx behavioral1/memory/2560-303-0x0000000000400000-0x00000000004CA000-memory.dmp upx -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\g: AZGAIQ.exe File opened (read-only) \??\k: AZGAIQ.exe File opened (read-only) \??\u: AZGAIQ.exe File opened (read-only) \??\w: AZGAIQ.exe File opened (read-only) \??\z: AZGAIQ.exe File opened (read-only) \??\a: AZGAIQ.exe File opened (read-only) \??\p: AZGAIQ.exe File opened (read-only) \??\l: AZGAIQ.exe File opened (read-only) \??\o: AZGAIQ.exe File opened (read-only) \??\y: AZGAIQ.exe File opened (read-only) \??\e: AZGAIQ.exe File opened (read-only) \??\h: AZGAIQ.exe File opened (read-only) \??\i: AZGAIQ.exe File opened (read-only) \??\j: AZGAIQ.exe File opened (read-only) \??\m: AZGAIQ.exe File opened (read-only) \??\n: AZGAIQ.exe File opened (read-only) \??\q: AZGAIQ.exe File opened (read-only) \??\r: AZGAIQ.exe File opened (read-only) \??\b: AZGAIQ.exe File opened (read-only) \??\t: AZGAIQ.exe File opened (read-only) \??\v: AZGAIQ.exe File opened (read-only) \??\x: AZGAIQ.exe File opened (read-only) \??\s: AZGAIQ.exe -
AutoIT Executable 14 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2560-181-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral1/memory/2560-190-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral1/memory/2560-199-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral1/memory/2560-210-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral1/memory/2560-218-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral1/memory/2560-228-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral1/memory/2560-237-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral1/memory/2560-248-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral1/memory/2560-257-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral1/memory/2560-266-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral1/memory/2560-276-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral1/memory/2560-285-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral1/memory/2560-294-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe behavioral1/memory/2560-303-0x0000000000400000-0x00000000004CA000-memory.dmp autoit_exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wl.jpg" AZGAIQ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Control Panel\Desktop AZGAIQ.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe 2560 AZGAIQ.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD55aa90a0f7830666ef1360b39cbb406db
SHA1f189fbf1ae1a75bab23e5aa0d950db1eb4b72fee
SHA256ddafb9b732aced96a8b9c3d6fbaa9d69b2c116b7e486270ea42df1b6bb6099fa
SHA5120ffd27800fe704c39f8444bb006a6b4e34d5e6443f89aaaf8a21b2f5ea2cf55ad768ed5e57d117f5950ce225ac7ba184a98a895eef7826687d8b09e2ec997a91
-
Filesize
8B
MD5de6fdff1993c731e52e49d52a6e684d9
SHA1120d1ff8a24109eed24ac1a5697383d50bcc0f47
SHA256645c2d0cb9f6edf276f7dead9ab8c72531cdae22f54962d174c1339c30cb1b42
SHA51299d05bf76a3a7466ccf27ac304ba35639716089d8dae388aaa707bfb6feb3f362251a65951663dd86abcac5a5e7358a5f29faedfe4c0b55ae136ba9d8f1209c1
