Analysis
-
max time kernel
146s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11-03-2024 00:02
Static task
static1
Behavioral task
behavioral1
Sample
bf4f7264ef324c5c14dccd8679685d3f.exe
Resource
win7-20240221-en
General
-
Target
bf4f7264ef324c5c14dccd8679685d3f.exe
-
Size
749KB
-
MD5
bf4f7264ef324c5c14dccd8679685d3f
-
SHA1
055a91cacfa6756ae1bf9d603ddea5e9b1b8f684
-
SHA256
8fdc412291f33a96a35c93d3d2bf03b338054509cd855f60109809a8e74100fe
-
SHA512
703b160a1ea781c12540f4bbba970b1d5d60be2bb83b0982cfb7b6e7b0db7d6cd50637c6c5a9cde433dc353f7228d157ec0400789272a47833c3d08438805e90
-
SSDEEP
12288:nUOTuurJr8VWrdMi4/Bfj+fqQ0eaQWH4X1/t6obHX8Rk+e8MTgtNxtxiF1kgDWS/:jrGVG2ZeaElv8lHz
Malware Config
Extracted
azorult
http://aka-mining.com/wordpress@/index.php
Extracted
asyncrat
0.5.7B
noip
rocking.ddns.net:55714
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
image.exe
-
install_folder
%Temp%
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2772-4-0x00000000002C0000-0x00000000002D6000-memory.dmp family_zgrat_v1 -
Async RAT payload 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\AsyncClient_noip.exe family_asyncrat -
Executes dropped EXE 3 IoCs
Processes:
AsyncClient_noip.exehttp.exeimage.exepid process 2424 AsyncClient_noip.exe 2696 http.exe 2840 image.exe -
Loads dropped DLL 4 IoCs
Processes:
RegAsm.execmd.exepid process 2920 RegAsm.exe 2920 RegAsm.exe 2920 RegAsm.exe 2364 cmd.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
bf4f7264ef324c5c14dccd8679685d3f.exedescription pid process target process PID 2772 set thread context of 2920 2772 bf4f7264ef324c5c14dccd8679685d3f.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2740 timeout.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
bf4f7264ef324c5c14dccd8679685d3f.exeAsyncClient_noip.exepid process 2772 bf4f7264ef324c5c14dccd8679685d3f.exe 2424 AsyncClient_noip.exe 2424 AsyncClient_noip.exe 2424 AsyncClient_noip.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
bf4f7264ef324c5c14dccd8679685d3f.exeAsyncClient_noip.exeimage.exedescription pid process Token: SeDebugPrivilege 2772 bf4f7264ef324c5c14dccd8679685d3f.exe Token: SeDebugPrivilege 2424 AsyncClient_noip.exe Token: SeDebugPrivilege 2840 image.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegAsm.exepid process 2920 RegAsm.exe -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
bf4f7264ef324c5c14dccd8679685d3f.exeRegAsm.exeAsyncClient_noip.execmd.execmd.exedescription pid process target process PID 2772 wrote to memory of 2988 2772 bf4f7264ef324c5c14dccd8679685d3f.exe RegAsm.exe PID 2772 wrote to memory of 2988 2772 bf4f7264ef324c5c14dccd8679685d3f.exe RegAsm.exe PID 2772 wrote to memory of 2988 2772 bf4f7264ef324c5c14dccd8679685d3f.exe RegAsm.exe PID 2772 wrote to memory of 2988 2772 bf4f7264ef324c5c14dccd8679685d3f.exe RegAsm.exe PID 2772 wrote to memory of 2988 2772 bf4f7264ef324c5c14dccd8679685d3f.exe RegAsm.exe PID 2772 wrote to memory of 2988 2772 bf4f7264ef324c5c14dccd8679685d3f.exe RegAsm.exe PID 2772 wrote to memory of 2988 2772 bf4f7264ef324c5c14dccd8679685d3f.exe RegAsm.exe PID 2772 wrote to memory of 2920 2772 bf4f7264ef324c5c14dccd8679685d3f.exe RegAsm.exe PID 2772 wrote to memory of 2920 2772 bf4f7264ef324c5c14dccd8679685d3f.exe RegAsm.exe PID 2772 wrote to memory of 2920 2772 bf4f7264ef324c5c14dccd8679685d3f.exe RegAsm.exe PID 2772 wrote to memory of 2920 2772 bf4f7264ef324c5c14dccd8679685d3f.exe RegAsm.exe PID 2772 wrote to memory of 2920 2772 bf4f7264ef324c5c14dccd8679685d3f.exe RegAsm.exe PID 2772 wrote to memory of 2920 2772 bf4f7264ef324c5c14dccd8679685d3f.exe RegAsm.exe PID 2772 wrote to memory of 2920 2772 bf4f7264ef324c5c14dccd8679685d3f.exe RegAsm.exe PID 2772 wrote to memory of 2920 2772 bf4f7264ef324c5c14dccd8679685d3f.exe RegAsm.exe PID 2772 wrote to memory of 2920 2772 bf4f7264ef324c5c14dccd8679685d3f.exe RegAsm.exe PID 2772 wrote to memory of 2920 2772 bf4f7264ef324c5c14dccd8679685d3f.exe RegAsm.exe PID 2772 wrote to memory of 2920 2772 bf4f7264ef324c5c14dccd8679685d3f.exe RegAsm.exe PID 2920 wrote to memory of 2424 2920 RegAsm.exe AsyncClient_noip.exe PID 2920 wrote to memory of 2424 2920 RegAsm.exe AsyncClient_noip.exe PID 2920 wrote to memory of 2424 2920 RegAsm.exe AsyncClient_noip.exe PID 2920 wrote to memory of 2424 2920 RegAsm.exe AsyncClient_noip.exe PID 2920 wrote to memory of 2696 2920 RegAsm.exe http.exe PID 2920 wrote to memory of 2696 2920 RegAsm.exe http.exe PID 2920 wrote to memory of 2696 2920 RegAsm.exe http.exe PID 2920 wrote to memory of 2696 2920 RegAsm.exe http.exe PID 2424 wrote to memory of 3016 2424 AsyncClient_noip.exe cmd.exe PID 2424 wrote to memory of 3016 2424 AsyncClient_noip.exe cmd.exe PID 2424 wrote to memory of 3016 2424 AsyncClient_noip.exe cmd.exe PID 2424 wrote to memory of 3016 2424 AsyncClient_noip.exe cmd.exe PID 2424 wrote to memory of 2364 2424 AsyncClient_noip.exe cmd.exe PID 2424 wrote to memory of 2364 2424 AsyncClient_noip.exe cmd.exe PID 2424 wrote to memory of 2364 2424 AsyncClient_noip.exe cmd.exe PID 2424 wrote to memory of 2364 2424 AsyncClient_noip.exe cmd.exe PID 3016 wrote to memory of 776 3016 cmd.exe schtasks.exe PID 3016 wrote to memory of 776 3016 cmd.exe schtasks.exe PID 3016 wrote to memory of 776 3016 cmd.exe schtasks.exe PID 3016 wrote to memory of 776 3016 cmd.exe schtasks.exe PID 2364 wrote to memory of 2740 2364 cmd.exe timeout.exe PID 2364 wrote to memory of 2740 2364 cmd.exe timeout.exe PID 2364 wrote to memory of 2740 2364 cmd.exe timeout.exe PID 2364 wrote to memory of 2740 2364 cmd.exe timeout.exe PID 2364 wrote to memory of 2840 2364 cmd.exe image.exe PID 2364 wrote to memory of 2840 2364 cmd.exe image.exe PID 2364 wrote to memory of 2840 2364 cmd.exe image.exe PID 2364 wrote to memory of 2840 2364 cmd.exe image.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf4f7264ef324c5c14dccd8679685d3f.exe"C:\Users\Admin\AppData\Local\Temp\bf4f7264ef324c5c14dccd8679685d3f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AsyncClient_noip.exe"C:\Users\Admin\AppData\Local\Temp\AsyncClient_noip.exe" 03⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "image" /tr '"C:\Users\Admin\AppData\Local\Temp\image.exe"' & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "image" /tr '"C:\Users\Admin\AppData\Local\Temp\image.exe"'5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp676A.tmp.bat""4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 35⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\image.exe"C:\Users\Admin\AppData\Local\Temp\image.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\http.exe"C:\Users\Admin\AppData\Local\Temp\http.exe" 03⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp676A.tmp.batFilesize
152B
MD50eb5e855220b9d1ff882a2114791d0fc
SHA1a40398e0c7627df9353922313a7ce8d9a3a068dd
SHA25668ca1bb3b409a9400881177819a2fa3554e549f281482f9ce9dda7b2639af85e
SHA512d7c4e014d5fdb4c9151af6f1f8770423c5c29672e88041bda04d86874479356245ac6b91c34b6f9b79c0f090d1f305801165e518a2c9dc0543bce4e81fdebec5
-
\Users\Admin\AppData\Local\Temp\AsyncClient_noip.exeFilesize
45KB
MD58c3cdf82f84a31b497d1373b787fd9bb
SHA1168da558ad0428adc45a480e3e4cee4bda362c4c
SHA256b26c1263561c56c98692762c18a0705bcf3b181f0ffc0681f7e9e3666b7036da
SHA51283449e8d7a27512735b5c1b3158bd2b45fb72d1ae8ac8b6dc3cd0938c9ea0d4667b85817ed034d2e9ff32bafbca2bca131615cebc11a8a210c6d87268a5821f6
-
\Users\Admin\AppData\Local\Temp\http.exeFilesize
112KB
MD5df42290ca661cacdbbd4c1a819ddfa15
SHA1cf4fe62f6157f61f7e737dc46c913037587d0d56
SHA2565b81be074935e496d7cfad72e6493986abd804adb37f3c7de41230c662968dbe
SHA512f6f289bf5935e8f01e3357155b95f9bdae6935eb98eb50322770bf437890b02a27f052cca6659029fc3773142a95c52a035e5019421f320572c3a12ba13428a8
-
memory/2424-36-0x0000000000C10000-0x0000000000C22000-memory.dmpFilesize
72KB
-
memory/2424-37-0x0000000074270000-0x000000007495E000-memory.dmpFilesize
6.9MB
-
memory/2424-38-0x0000000000A70000-0x0000000000AB0000-memory.dmpFilesize
256KB
-
memory/2424-47-0x0000000074270000-0x000000007495E000-memory.dmpFilesize
6.9MB
-
memory/2696-60-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2696-57-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2696-54-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2772-2-0x0000000004DE0000-0x0000000004E20000-memory.dmpFilesize
256KB
-
memory/2772-1-0x0000000074770000-0x0000000074E5E000-memory.dmpFilesize
6.9MB
-
memory/2772-0-0x0000000000F00000-0x0000000000FC2000-memory.dmpFilesize
776KB
-
memory/2772-15-0x0000000074770000-0x0000000074E5E000-memory.dmpFilesize
6.9MB
-
memory/2772-3-0x0000000000A60000-0x0000000000AC2000-memory.dmpFilesize
392KB
-
memory/2772-4-0x00000000002C0000-0x00000000002D6000-memory.dmpFilesize
88KB
-
memory/2840-52-0x0000000000990000-0x00000000009A2000-memory.dmpFilesize
72KB
-
memory/2840-53-0x0000000074390000-0x0000000074A7E000-memory.dmpFilesize
6.9MB
-
memory/2840-55-0x0000000004400000-0x0000000004440000-memory.dmpFilesize
256KB
-
memory/2840-58-0x0000000074390000-0x0000000074A7E000-memory.dmpFilesize
6.9MB
-
memory/2920-35-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2920-16-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2920-13-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2920-9-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2920-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2920-7-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2920-5-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB