Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
10-03-2024 04:26
Behavioral task
behavioral1
Sample
bda8a38ed2a51c1799de30b2c051fde9.exe
Resource
win7-20240215-en
General
-
Target
bda8a38ed2a51c1799de30b2c051fde9.exe
-
Size
3.1MB
-
MD5
bda8a38ed2a51c1799de30b2c051fde9
-
SHA1
b4649ddc6bd605a564e815b108ff5ac405f9a3b9
-
SHA256
4d5a4068ee6d03be9efeae0b07828807454697e1f15eb4ed2fde59579c3ad1c2
-
SHA512
df84d96bdc77e286afab0e19f9516175a6bbb2be02ad7d65abd8b1efb538c88c631739454bf3e434966f729bc17bd93ab79882142a7ee603296b8976ac4809c3
-
SSDEEP
98304:GdNIA2b8lIpIta0Icq+KPtYulORjiCSHwdlPtqM7RcS4FIKU21IEfrNdSf8x:GdNB4ianUstYuUR2CSHsVP8x
Malware Config
Extracted
netwire
174.127.99.159:7882
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
May-B
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Extracted
azorult
https://gemateknindoperkasa.co.id/imag/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
NetWire RAT payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/2604-30-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/2604-32-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/2604-34-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/2604-36-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/2604-39-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/2604-42-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/2604-43-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Executes dropped EXE 5 IoCs
Processes:
test.exeFile.exesvhost.exetmp.exesvhost.exepid process 2636 test.exe 2932 File.exe 2604 svhost.exe 2520 tmp.exe 2736 svhost.exe -
Loads dropped DLL 8 IoCs
Processes:
cmd.exetest.exeFile.exepid process 2572 cmd.exe 2636 test.exe 2636 test.exe 2932 File.exe 2932 File.exe 2932 File.exe 2636 test.exe 2932 File.exe -
Processes:
resource yara_rule behavioral1/memory/1772-1-0x0000000000400000-0x0000000000B9D000-memory.dmp upx behavioral1/memory/1772-81-0x0000000000400000-0x0000000000B9D000-memory.dmp upx behavioral1/memory/1772-85-0x0000000000400000-0x0000000000B9D000-memory.dmp upx -
Suspicious use of SetThreadContext 2 IoCs
Processes:
test.exeFile.exedescription pid process target process PID 2636 set thread context of 2604 2636 test.exe svhost.exe PID 2932 set thread context of 2736 2932 File.exe svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NTFS ADS 2 IoCs
Processes:
cmd.execmd.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier cmd.exe File created C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier cmd.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
test.exeFile.exepid process 2636 test.exe 2932 File.exe 2636 test.exe 2636 test.exe 2932 File.exe 2932 File.exe 2636 test.exe 2932 File.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
test.exeFile.exedescription pid process Token: SeDebugPrivilege 2636 test.exe Token: SeDebugPrivilege 2932 File.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
bda8a38ed2a51c1799de30b2c051fde9.execmd.exetest.exeFile.execmd.exedescription pid process target process PID 1772 wrote to memory of 2572 1772 bda8a38ed2a51c1799de30b2c051fde9.exe cmd.exe PID 1772 wrote to memory of 2572 1772 bda8a38ed2a51c1799de30b2c051fde9.exe cmd.exe PID 1772 wrote to memory of 2572 1772 bda8a38ed2a51c1799de30b2c051fde9.exe cmd.exe PID 1772 wrote to memory of 2572 1772 bda8a38ed2a51c1799de30b2c051fde9.exe cmd.exe PID 2572 wrote to memory of 2636 2572 cmd.exe test.exe PID 2572 wrote to memory of 2636 2572 cmd.exe test.exe PID 2572 wrote to memory of 2636 2572 cmd.exe test.exe PID 2572 wrote to memory of 2636 2572 cmd.exe test.exe PID 2572 wrote to memory of 2636 2572 cmd.exe test.exe PID 2572 wrote to memory of 2636 2572 cmd.exe test.exe PID 2572 wrote to memory of 2636 2572 cmd.exe test.exe PID 2636 wrote to memory of 2932 2636 test.exe File.exe PID 2636 wrote to memory of 2932 2636 test.exe File.exe PID 2636 wrote to memory of 2932 2636 test.exe File.exe PID 2636 wrote to memory of 2932 2636 test.exe File.exe PID 2636 wrote to memory of 2932 2636 test.exe File.exe PID 2636 wrote to memory of 2932 2636 test.exe File.exe PID 2636 wrote to memory of 2932 2636 test.exe File.exe PID 2636 wrote to memory of 2604 2636 test.exe svhost.exe PID 2636 wrote to memory of 2604 2636 test.exe svhost.exe PID 2636 wrote to memory of 2604 2636 test.exe svhost.exe PID 2636 wrote to memory of 2604 2636 test.exe svhost.exe PID 2636 wrote to memory of 2604 2636 test.exe svhost.exe PID 2636 wrote to memory of 2604 2636 test.exe svhost.exe PID 2636 wrote to memory of 2604 2636 test.exe svhost.exe PID 2636 wrote to memory of 2604 2636 test.exe svhost.exe PID 2636 wrote to memory of 2604 2636 test.exe svhost.exe PID 2636 wrote to memory of 2604 2636 test.exe svhost.exe PID 2636 wrote to memory of 2604 2636 test.exe svhost.exe PID 2636 wrote to memory of 2604 2636 test.exe svhost.exe PID 2636 wrote to memory of 2448 2636 test.exe cmd.exe PID 2636 wrote to memory of 2448 2636 test.exe cmd.exe PID 2636 wrote to memory of 2448 2636 test.exe cmd.exe PID 2636 wrote to memory of 2448 2636 test.exe cmd.exe PID 2932 wrote to memory of 2520 2932 File.exe tmp.exe PID 2932 wrote to memory of 2520 2932 File.exe tmp.exe PID 2932 wrote to memory of 2520 2932 File.exe tmp.exe PID 2932 wrote to memory of 2520 2932 File.exe tmp.exe PID 2636 wrote to memory of 2492 2636 test.exe cmd.exe PID 2636 wrote to memory of 2492 2636 test.exe cmd.exe PID 2636 wrote to memory of 2492 2636 test.exe cmd.exe PID 2636 wrote to memory of 2492 2636 test.exe cmd.exe PID 2492 wrote to memory of 2404 2492 cmd.exe reg.exe PID 2492 wrote to memory of 2404 2492 cmd.exe reg.exe PID 2492 wrote to memory of 2404 2492 cmd.exe reg.exe PID 2492 wrote to memory of 2404 2492 cmd.exe reg.exe PID 2932 wrote to memory of 2736 2932 File.exe svhost.exe PID 2932 wrote to memory of 2736 2932 File.exe svhost.exe PID 2932 wrote to memory of 2736 2932 File.exe svhost.exe PID 2932 wrote to memory of 2736 2932 File.exe svhost.exe PID 2932 wrote to memory of 2736 2932 File.exe svhost.exe PID 2932 wrote to memory of 2736 2932 File.exe svhost.exe PID 2932 wrote to memory of 2736 2932 File.exe svhost.exe PID 2932 wrote to memory of 2736 2932 File.exe svhost.exe PID 2932 wrote to memory of 2736 2932 File.exe svhost.exe PID 2932 wrote to memory of 2736 2932 File.exe svhost.exe PID 2636 wrote to memory of 1864 2636 test.exe cmd.exe PID 2636 wrote to memory of 1864 2636 test.exe cmd.exe PID 2636 wrote to memory of 1864 2636 test.exe cmd.exe PID 2636 wrote to memory of 1864 2636 test.exe cmd.exe PID 2932 wrote to memory of 332 2932 File.exe cmd.exe PID 2932 wrote to memory of 332 2932 File.exe cmd.exe PID 2932 wrote to memory of 332 2932 File.exe cmd.exe PID 2932 wrote to memory of 332 2932 File.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bda8a38ed2a51c1799de30b2c051fde9.exe"C:\Users\Admin\AppData\Local\Temp\bda8a38ed2a51c1799de30b2c051fde9.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c test.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\test.exetest.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\File.exe"C:\Users\Admin\AppData\Local\Temp\File.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\tmp.exe"C:\Users\Admin\AppData\Roaming\tmp.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/File.exe" "%temp%\FolderN\name.exe" /Y5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f5⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier5⤵
- NTFS ADS
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/test.exe" "%temp%\FolderN\name.exe" /Y4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier4⤵
- NTFS ADS
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\FolderN\name.exeFilesize
342KB
MD55e9f0da4b9f75200affc0e4cfc5da8de
SHA1dfff1fd74e8f82d062e3d28f6e0683f79008d2f1
SHA25688adb1c190c3e0011c3d4815255c3928a07d443e8d0b5ff5e2796cc40cdb4cb5
SHA5126dfef40c33d77d9299a49a9da935214c537123164ba8edac7debd4d734c12b4ccc688fd5f3ca188b3e9a0e219d8defaae1eeb4300b01f3f4c56063fb899cce7d
-
C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnkFilesize
947B
MD57b1200c8516a9eb1aa1ae8c671635283
SHA103087b2faeaf211d95713ca3708a43ff38303bf3
SHA2561b9dd87d5eeff77d78a24b2c02cef644604daf9f6bd80fb26e24791e51e982d2
SHA512e81d16cbc5e7061f5a44e5ce0f1146b02e9d6e88cf2736bf121d508698e553daf0f6b8e15aa909af3b8dc6abb5337d56fc1e7ef36690d23d334e3a5fd5ad688c
-
\Users\Admin\AppData\Local\Temp\File.exeFilesize
342KB
MD537c82e15058e2f8f5e9525b956e6440d
SHA13bf20d00bd7a7943c4066d534f5b276cac5ae39f
SHA25680c4716318f874881151c78c4dce9a0a01be4294834f33ee7f12a8a34bb8b2b7
SHA5125c9c37a13cac634771ae18736845b8e7c1a33fd8c6c9ae564f6863b5033a68565f0fd3da555d15870bbc547cc549153c096c44f2d7ced828baffdcfa8641da0a
-
\Users\Admin\AppData\Local\Temp\svhost.exeFilesize
255KB
MD59af17c8393f0970ee5136bd3ffa27001
SHA14b285b72c1a11285a25f31f2597e090da6bbc049
SHA25671d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019
SHA512b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3
-
\Users\Admin\AppData\Local\Temp\test.exeFilesize
931KB
MD5836cda1d8a9718485cc9f9653530c2d9
SHA1fca85ff9aa624547d9a315962d82388c300edac1
SHA256d3793a581da66ef5840648574ce364846e7c68a559c0f5e49faf9e4892ecdc72
SHA51207ca078d79f622706d08a534f6b5e2c896152fb0d0e452781fa6be5dc90028fdf074b3b78acac438f2acf5b3f5522e70afb7db4551874a3083860213e2790481
-
\Users\Admin\AppData\Roaming\tmp.exeFilesize
112KB
MD5bae2b04e1160950e570661f55d7cd6f8
SHA1f4abc073a091292547dda85d0ba044cab231c8da
SHA256ab0744c19af062c698e94e8eb9ee0e67bcf9a078f53d2a6a848406e2413c4d59
SHA5121bfef1217a6e2ecacee407eed70df9205cbfabb4ddfe06fcc11a7ddf2b42262ec3ab61421474b56b338fa76ffea9beac73530650d39eff61dffcfc25a7fe45b6
-
memory/1772-81-0x0000000000400000-0x0000000000B9D000-memory.dmpFilesize
7.6MB
-
memory/1772-85-0x0000000000400000-0x0000000000B9D000-memory.dmpFilesize
7.6MB
-
memory/1772-1-0x0000000000400000-0x0000000000B9D000-memory.dmpFilesize
7.6MB
-
memory/2520-79-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2604-28-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2604-38-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/2604-24-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2604-26-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2604-43-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2604-30-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2604-32-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2604-34-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2604-36-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2604-42-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2604-39-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2636-82-0x0000000074A40000-0x000000007512E000-memory.dmpFilesize
6.9MB
-
memory/2636-83-0x0000000004BB0000-0x0000000004BF0000-memory.dmpFilesize
256KB
-
memory/2636-84-0x0000000074A40000-0x000000007512E000-memory.dmpFilesize
6.9MB
-
memory/2636-8-0x0000000004760000-0x00000000047E6000-memory.dmpFilesize
536KB
-
memory/2636-7-0x0000000004BB0000-0x0000000004BF0000-memory.dmpFilesize
256KB
-
memory/2636-6-0x0000000074A40000-0x000000007512E000-memory.dmpFilesize
6.9MB
-
memory/2636-5-0x0000000000AD0000-0x0000000000BBE000-memory.dmpFilesize
952KB
-
memory/2736-63-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2736-62-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/2736-61-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2736-67-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2736-68-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2736-60-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2736-59-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2736-58-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2736-57-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2932-19-0x0000000000300000-0x0000000000324000-memory.dmpFilesize
144KB
-
memory/2932-18-0x00000000049F0000-0x0000000004A30000-memory.dmpFilesize
256KB
-
memory/2932-17-0x00000000001E0000-0x000000000023C000-memory.dmpFilesize
368KB
-
memory/2932-16-0x0000000074A40000-0x000000007512E000-memory.dmpFilesize
6.9MB
-
memory/2932-86-0x0000000074A40000-0x000000007512E000-memory.dmpFilesize
6.9MB