Analysis

  • max time kernel
    120s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    26-02-2024 08:48

General

  • Target

    a5ee020839ba46412eb4e55719c397c2.exe

  • Size

    3.1MB

  • MD5

    a5ee020839ba46412eb4e55719c397c2

  • SHA1

    7c5e2dfbdcc13984374ee8adee0966357c90f559

  • SHA256

    682078b3572553335e5a6410d5e0e3f2b6b1dbd2d32a57da31f63f1f604cbe6c

  • SHA512

    258c02451079d97b1c24fa7ba35f4b9cdd253f2bf508b53d42314f1d13cc89239fad8819d8009a992c71a71585670fae4e5238eb17a982e5cde588f6f247eaf2

  • SSDEEP

    98304:ddNIA2b8lIpIta0Icq+KPtYulORjiCSHwdlPtqM7RcS4FIKU21IEfrNdSf8a:ddNB4ianUstYuUR2CSHsVP8a

Malware Config

Extracted

Family

netwire

C2

174.127.99.159:7882

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    May-B

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    Password

  • registry_autorun

    false

  • use_mutex

    false

Extracted

Family

azorult

C2

https://gemateknindoperkasa.co.id/imag/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • NetWire RAT payload 7 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 8 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a5ee020839ba46412eb4e55719c397c2.exe
    "C:\Users\Admin\AppData\Local\Temp\a5ee020839ba46412eb4e55719c397c2.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2376
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c test.exe
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2668
      • C:\Users\Admin\AppData\Local\Temp\test.exe
        test.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2596
        • C:\Users\Admin\AppData\Local\Temp\File.exe
          "C:\Users\Admin\AppData\Local\Temp\File.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2684
          • C:\Users\Admin\AppData\Roaming\tmp.exe
            "C:\Users\Admin\AppData\Roaming\tmp.exe"
            5⤵
            • Executes dropped EXE
            PID:2864
          • C:\Users\Admin\AppData\Local\Temp\svhost.exe
            "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
            5⤵
            • Executes dropped EXE
            PID:1616
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/File.exe" "%temp%\FolderN\name.exe" /Y
            5⤵
              PID:1952
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f
              5⤵
                PID:2360
                • C:\Windows\SysWOW64\reg.exe
                  reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f
                  6⤵
                    PID:2344
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier
                  5⤵
                  • NTFS ADS
                  PID:784
              • C:\Users\Admin\AppData\Local\Temp\svhost.exe
                "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
                4⤵
                • Executes dropped EXE
                PID:2680
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/test.exe" "%temp%\FolderN\name.exe" /Y
                4⤵
                  PID:2096
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2480
                  • C:\Windows\SysWOW64\reg.exe
                    reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f
                    5⤵
                      PID:2400
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier
                    4⤵
                    • NTFS ADS
                    PID:832

            Network

            MITRE ATT&CK Matrix ATT&CK v13

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe
              Filesize

              342KB

              MD5

              e74026c1c82c299914219bc5d5e1ede8

              SHA1

              096a9f0f99888680d5aa9c4a009414c24deffe29

              SHA256

              6aef1d6af2befc9311ca58fa266bd2ffaec776f3669207a82f9e76ab3df03200

              SHA512

              6038bab66f21a91c3c8069a4df861be662c5999b3bf3a33beebf20c9ecf8fab974e01df7afb93bc549c3f63908b18d9a03af97145615da352d8aae97600ceb72

            • C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk
              Filesize

              951B

              MD5

              a7958ce3af7b19ed0147cc03eabf0025

              SHA1

              d770fa2d9820e8b4f5a15faf7da6197e1c9b49f7

              SHA256

              10029d90670aab72e06834ca15b80339b330c39ee3f04369f0c9b9a4bce02d66

              SHA512

              021369a4a73e6a594388de5111f738ef18c8c71fd02cbe34e2da9065a7837dcb911590e107ae0203fd41cb6a66a5b6963e07755e2275efdf9d93609251412dac

            • \Users\Admin\AppData\Local\Temp\File.exe
              Filesize

              342KB

              MD5

              37c82e15058e2f8f5e9525b956e6440d

              SHA1

              3bf20d00bd7a7943c4066d534f5b276cac5ae39f

              SHA256

              80c4716318f874881151c78c4dce9a0a01be4294834f33ee7f12a8a34bb8b2b7

              SHA512

              5c9c37a13cac634771ae18736845b8e7c1a33fd8c6c9ae564f6863b5033a68565f0fd3da555d15870bbc547cc549153c096c44f2d7ced828baffdcfa8641da0a

            • \Users\Admin\AppData\Local\Temp\FolderN\name.exe
              Filesize

              664KB

              MD5

              cc040a7c8302765353fc1711a489b51c

              SHA1

              4227a584e83cfc3abdad9aef6819a0760a361840

              SHA256

              be3d7ca5accd6b985ff9cff1339181b4ebdec9761c26f953c31ff53dd2d0637d

              SHA512

              de5f8b1d5cba0086335c34587e3c664f3fc7e47a114358566d47bbf613cfd55e756b44d59ca3d5b21a19267bbf63195cf7747298a2d86859da3f40d29210862b

            • \Users\Admin\AppData\Local\Temp\svhost.exe
              Filesize

              255KB

              MD5

              9af17c8393f0970ee5136bd3ffa27001

              SHA1

              4b285b72c1a11285a25f31f2597e090da6bbc049

              SHA256

              71d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019

              SHA512

              b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3

            • \Users\Admin\AppData\Local\Temp\test.exe
              Filesize

              931KB

              MD5

              836cda1d8a9718485cc9f9653530c2d9

              SHA1

              fca85ff9aa624547d9a315962d82388c300edac1

              SHA256

              d3793a581da66ef5840648574ce364846e7c68a559c0f5e49faf9e4892ecdc72

              SHA512

              07ca078d79f622706d08a534f6b5e2c896152fb0d0e452781fa6be5dc90028fdf074b3b78acac438f2acf5b3f5522e70afb7db4551874a3083860213e2790481

            • \Users\Admin\AppData\Roaming\tmp.exe
              Filesize

              112KB

              MD5

              bae2b04e1160950e570661f55d7cd6f8

              SHA1

              f4abc073a091292547dda85d0ba044cab231c8da

              SHA256

              ab0744c19af062c698e94e8eb9ee0e67bcf9a078f53d2a6a848406e2413c4d59

              SHA512

              1bfef1217a6e2ecacee407eed70df9205cbfabb4ddfe06fcc11a7ddf2b42262ec3ab61421474b56b338fa76ffea9beac73530650d39eff61dffcfc25a7fe45b6

            • memory/1616-60-0x0000000000400000-0x0000000000420000-memory.dmp
              Filesize

              128KB

            • memory/1616-64-0x0000000000401000-0x000000000041B000-memory.dmp
              Filesize

              104KB

            • memory/1616-52-0x0000000000400000-0x0000000000420000-memory.dmp
              Filesize

              128KB

            • memory/1616-56-0x0000000000400000-0x0000000000420000-memory.dmp
              Filesize

              128KB

            • memory/1616-57-0x0000000000400000-0x0000000000420000-memory.dmp
              Filesize

              128KB

            • memory/1616-58-0x0000000000400000-0x0000000000420000-memory.dmp
              Filesize

              128KB

            • memory/1616-54-0x0000000000400000-0x0000000000420000-memory.dmp
              Filesize

              128KB

            • memory/1616-63-0x0000000000400000-0x0000000000420000-memory.dmp
              Filesize

              128KB

            • memory/2376-78-0x0000000000400000-0x0000000000B9D000-memory.dmp
              Filesize

              7.6MB

            • memory/2376-1-0x0000000000400000-0x0000000000B9D000-memory.dmp
              Filesize

              7.6MB

            • memory/2376-83-0x0000000000400000-0x0000000000B9D000-memory.dmp
              Filesize

              7.6MB

            • memory/2596-5-0x0000000000D90000-0x0000000000E7E000-memory.dmp
              Filesize

              952KB

            • memory/2596-7-0x0000000000630000-0x0000000000670000-memory.dmp
              Filesize

              256KB

            • memory/2596-8-0x0000000004420000-0x00000000044A6000-memory.dmp
              Filesize

              536KB

            • memory/2596-82-0x0000000073F70000-0x000000007465E000-memory.dmp
              Filesize

              6.9MB

            • memory/2596-79-0x0000000073F70000-0x000000007465E000-memory.dmp
              Filesize

              6.9MB

            • memory/2596-6-0x0000000073F70000-0x000000007465E000-memory.dmp
              Filesize

              6.9MB

            • memory/2596-80-0x0000000000630000-0x0000000000670000-memory.dmp
              Filesize

              256KB

            • memory/2680-34-0x0000000000400000-0x0000000000433000-memory.dmp
              Filesize

              204KB

            • memory/2680-24-0x0000000000400000-0x0000000000433000-memory.dmp
              Filesize

              204KB

            • memory/2680-37-0x0000000000400000-0x0000000000433000-memory.dmp
              Filesize

              204KB

            • memory/2680-33-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp
              Filesize

              4KB

            • memory/2680-32-0x0000000000400000-0x0000000000433000-memory.dmp
              Filesize

              204KB

            • memory/2680-31-0x0000000000400000-0x0000000000433000-memory.dmp
              Filesize

              204KB

            • memory/2680-30-0x0000000000400000-0x0000000000433000-memory.dmp
              Filesize

              204KB

            • memory/2680-29-0x0000000000400000-0x0000000000433000-memory.dmp
              Filesize

              204KB

            • memory/2680-28-0x0000000000400000-0x0000000000433000-memory.dmp
              Filesize

              204KB

            • memory/2680-38-0x0000000000400000-0x0000000000433000-memory.dmp
              Filesize

              204KB

            • memory/2680-26-0x0000000000400000-0x0000000000433000-memory.dmp
              Filesize

              204KB

            • memory/2684-18-0x0000000000280000-0x00000000002A4000-memory.dmp
              Filesize

              144KB

            • memory/2684-19-0x0000000004340000-0x0000000004380000-memory.dmp
              Filesize

              256KB

            • memory/2684-81-0x0000000073F70000-0x000000007465E000-memory.dmp
              Filesize

              6.9MB

            • memory/2684-17-0x0000000073F70000-0x000000007465E000-memory.dmp
              Filesize

              6.9MB

            • memory/2684-16-0x00000000000D0000-0x000000000012C000-memory.dmp
              Filesize

              368KB

            • memory/2684-84-0x0000000073F70000-0x000000007465E000-memory.dmp
              Filesize

              6.9MB

            • memory/2864-72-0x0000000000400000-0x0000000000420000-memory.dmp
              Filesize

              128KB