Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13-03-2024 23:55
Behavioral task
behavioral1
Sample
c72b24524f8287ae8cf4273a4ef61573.exe
Resource
win7-20240215-en
General
-
Target
c72b24524f8287ae8cf4273a4ef61573.exe
-
Size
3.1MB
-
MD5
c72b24524f8287ae8cf4273a4ef61573
-
SHA1
b5fc35c2c1a3b608b2ce52772c1befa82aeff392
-
SHA256
162cfa86a5f385b1c2e5767c1eff60abd637fea8e7a2ba37256ff3e0437c802f
-
SHA512
7b0f69949089f6238a07d6087b6fc53979ee5e0c33cc3f2310af6ec185012a29981e008ca83f1198f66b7b776a1180519ea7154f6c633a3aae62f2138eee4bf9
-
SSDEEP
98304:sdNIA2b8lIpIta0Icq+KPtYulORjiCSHwdlPtqM7RcS4FIKU21IEfrNdSf8x:sdNB4ianUstYuUR2CSHsVP8x
Malware Config
Extracted
netwire
174.127.99.159:7882
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
May-B
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Extracted
azorult
https://gemateknindoperkasa.co.id/imag/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
NetWire RAT payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2756-27-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/2756-30-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/2756-31-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral2/memory/2756-68-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
File.exetest.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation File.exe Key value queried \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation test.exe -
Executes dropped EXE 5 IoCs
Processes:
test.exeFile.exesvhost.exetmp.exesvhost.exepid process 3636 test.exe 3076 File.exe 2756 svhost.exe 4636 tmp.exe 3432 svhost.exe -
Processes:
resource yara_rule behavioral2/memory/1672-0-0x0000000000400000-0x0000000000B9D000-memory.dmp upx behavioral2/memory/1672-59-0x0000000000400000-0x0000000000B9D000-memory.dmp upx behavioral2/memory/1672-65-0x0000000000400000-0x0000000000B9D000-memory.dmp upx -
Suspicious use of SetThreadContext 2 IoCs
Processes:
test.exeFile.exedescription pid process target process PID 3636 set thread context of 2756 3636 test.exe svhost.exe PID 3076 set thread context of 3432 3076 File.exe svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NTFS ADS 2 IoCs
Processes:
cmd.execmd.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier cmd.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier cmd.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
test.exeFile.exepid process 3636 test.exe 3076 File.exe 3636 test.exe 3636 test.exe 3076 File.exe 3076 File.exe 3636 test.exe 3076 File.exe 3636 test.exe 3076 File.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
test.exeFile.exedescription pid process Token: SeDebugPrivilege 3636 test.exe Token: SeDebugPrivilege 3076 File.exe -
Suspicious use of WriteProcessMemory 56 IoCs
Processes:
c72b24524f8287ae8cf4273a4ef61573.execmd.exetest.exeFile.execmd.execmd.exedescription pid process target process PID 1672 wrote to memory of 3964 1672 c72b24524f8287ae8cf4273a4ef61573.exe cmd.exe PID 1672 wrote to memory of 3964 1672 c72b24524f8287ae8cf4273a4ef61573.exe cmd.exe PID 1672 wrote to memory of 3964 1672 c72b24524f8287ae8cf4273a4ef61573.exe cmd.exe PID 3964 wrote to memory of 3636 3964 cmd.exe test.exe PID 3964 wrote to memory of 3636 3964 cmd.exe test.exe PID 3964 wrote to memory of 3636 3964 cmd.exe test.exe PID 3636 wrote to memory of 3076 3636 test.exe File.exe PID 3636 wrote to memory of 3076 3636 test.exe File.exe PID 3636 wrote to memory of 3076 3636 test.exe File.exe PID 3636 wrote to memory of 2756 3636 test.exe svhost.exe PID 3636 wrote to memory of 2756 3636 test.exe svhost.exe PID 3636 wrote to memory of 2756 3636 test.exe svhost.exe PID 3636 wrote to memory of 2756 3636 test.exe svhost.exe PID 3636 wrote to memory of 2756 3636 test.exe svhost.exe PID 3636 wrote to memory of 2756 3636 test.exe svhost.exe PID 3636 wrote to memory of 2756 3636 test.exe svhost.exe PID 3636 wrote to memory of 2756 3636 test.exe svhost.exe PID 3636 wrote to memory of 2756 3636 test.exe svhost.exe PID 3636 wrote to memory of 2756 3636 test.exe svhost.exe PID 3636 wrote to memory of 2756 3636 test.exe svhost.exe PID 3636 wrote to memory of 2404 3636 test.exe cmd.exe PID 3636 wrote to memory of 2404 3636 test.exe cmd.exe PID 3636 wrote to memory of 2404 3636 test.exe cmd.exe PID 3076 wrote to memory of 4636 3076 File.exe tmp.exe PID 3076 wrote to memory of 4636 3076 File.exe tmp.exe PID 3076 wrote to memory of 4636 3076 File.exe tmp.exe PID 3076 wrote to memory of 3432 3076 File.exe svhost.exe PID 3076 wrote to memory of 3432 3076 File.exe svhost.exe PID 3076 wrote to memory of 3432 3076 File.exe svhost.exe PID 3076 wrote to memory of 3432 3076 File.exe svhost.exe PID 3076 wrote to memory of 3432 3076 File.exe svhost.exe PID 3076 wrote to memory of 3432 3076 File.exe svhost.exe PID 3076 wrote to memory of 3432 3076 File.exe svhost.exe PID 3076 wrote to memory of 3432 3076 File.exe svhost.exe PID 3076 wrote to memory of 3432 3076 File.exe svhost.exe PID 3636 wrote to memory of 2568 3636 test.exe cmd.exe PID 3636 wrote to memory of 2568 3636 test.exe cmd.exe PID 3636 wrote to memory of 2568 3636 test.exe cmd.exe PID 3076 wrote to memory of 2292 3076 File.exe cmd.exe PID 3076 wrote to memory of 2292 3076 File.exe cmd.exe PID 3076 wrote to memory of 2292 3076 File.exe cmd.exe PID 2568 wrote to memory of 3524 2568 cmd.exe reg.exe PID 2568 wrote to memory of 3524 2568 cmd.exe reg.exe PID 2568 wrote to memory of 3524 2568 cmd.exe reg.exe PID 3076 wrote to memory of 4772 3076 File.exe cmd.exe PID 3076 wrote to memory of 4772 3076 File.exe cmd.exe PID 3076 wrote to memory of 4772 3076 File.exe cmd.exe PID 3636 wrote to memory of 216 3636 test.exe cmd.exe PID 3636 wrote to memory of 216 3636 test.exe cmd.exe PID 3636 wrote to memory of 216 3636 test.exe cmd.exe PID 4772 wrote to memory of 376 4772 cmd.exe reg.exe PID 4772 wrote to memory of 376 4772 cmd.exe reg.exe PID 4772 wrote to memory of 376 4772 cmd.exe reg.exe PID 3076 wrote to memory of 2544 3076 File.exe cmd.exe PID 3076 wrote to memory of 2544 3076 File.exe cmd.exe PID 3076 wrote to memory of 2544 3076 File.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c72b24524f8287ae8cf4273a4ef61573.exe"C:\Users\Admin\AppData\Local\Temp\c72b24524f8287ae8cf4273a4ef61573.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c test.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\test.exetest.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\File.exe"C:\Users\Admin\AppData\Local\Temp\File.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\tmp.exe"C:\Users\Admin\AppData\Roaming\tmp.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/File.exe" "%temp%\FolderN\name.exe" /Y5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier5⤵
- NTFS ADS
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/test.exe" "%temp%\FolderN\name.exe" /Y4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier4⤵
- NTFS ADS
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\File.exeFilesize
342KB
MD537c82e15058e2f8f5e9525b956e6440d
SHA13bf20d00bd7a7943c4066d534f5b276cac5ae39f
SHA25680c4716318f874881151c78c4dce9a0a01be4294834f33ee7f12a8a34bb8b2b7
SHA5125c9c37a13cac634771ae18736845b8e7c1a33fd8c6c9ae564f6863b5033a68565f0fd3da555d15870bbc547cc549153c096c44f2d7ced828baffdcfa8641da0a
-
C:\Users\Admin\AppData\Local\Temp\FolderN\name.exeMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnkFilesize
1KB
MD5f91aa40b48c76463628095bfada137d8
SHA1bec165d9a5df8841ae443b367d21009886f034ef
SHA25608912f54258a8f4429bfc845cff296fbf5203415d92c5a02f9b528c199ca4b48
SHA512415a1a68670d49d5233adb5b13f2b330c6d90bdd07f72b84132a5c30d9860c24aea5fa4b01dbca8f26e3d4447d960da34e9c22500c5c3169d3130da2a0d4301d
-
C:\Users\Admin\AppData\Local\Temp\svhost.exeFilesize
256KB
MD58fdf47e0ff70c40ed3a17014aeea4232
SHA1e6256a0159688f0560b015da4d967f41cbf8c9bd
SHA256ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82
SHA512bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be
-
C:\Users\Admin\AppData\Local\Temp\test.exeFilesize
931KB
MD5836cda1d8a9718485cc9f9653530c2d9
SHA1fca85ff9aa624547d9a315962d82388c300edac1
SHA256d3793a581da66ef5840648574ce364846e7c68a559c0f5e49faf9e4892ecdc72
SHA51207ca078d79f622706d08a534f6b5e2c896152fb0d0e452781fa6be5dc90028fdf074b3b78acac438f2acf5b3f5522e70afb7db4551874a3083860213e2790481
-
C:\Users\Admin\AppData\Roaming\tmp.exeFilesize
112KB
MD5bae2b04e1160950e570661f55d7cd6f8
SHA1f4abc073a091292547dda85d0ba044cab231c8da
SHA256ab0744c19af062c698e94e8eb9ee0e67bcf9a078f53d2a6a848406e2413c4d59
SHA5121bfef1217a6e2ecacee407eed70df9205cbfabb4ddfe06fcc11a7ddf2b42262ec3ab61421474b56b338fa76ffea9beac73530650d39eff61dffcfc25a7fe45b6
-
memory/1672-65-0x0000000000400000-0x0000000000B9D000-memory.dmpFilesize
7.6MB
-
memory/1672-59-0x0000000000400000-0x0000000000B9D000-memory.dmpFilesize
7.6MB
-
memory/1672-0-0x0000000000400000-0x0000000000B9D000-memory.dmpFilesize
7.6MB
-
memory/2756-30-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2756-27-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2756-31-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2756-68-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/3076-62-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/3076-23-0x00000000054F0000-0x0000000005500000-memory.dmpFilesize
64KB
-
memory/3076-22-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/3076-21-0x0000000000980000-0x00000000009DC000-memory.dmpFilesize
368KB
-
memory/3076-24-0x0000000005210000-0x0000000005234000-memory.dmpFilesize
144KB
-
memory/3076-67-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/3432-41-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3432-46-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3432-47-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3636-8-0x0000000005360000-0x0000000005370000-memory.dmpFilesize
64KB
-
memory/3636-6-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/3636-60-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/3636-61-0x0000000005360000-0x0000000005370000-memory.dmpFilesize
64KB
-
memory/3636-7-0x0000000005400000-0x000000000549C000-memory.dmpFilesize
624KB
-
memory/3636-64-0x00000000750E0000-0x0000000075890000-memory.dmpFilesize
7.7MB
-
memory/3636-5-0x00000000009D0000-0x0000000000ABE000-memory.dmpFilesize
952KB
-
memory/3636-9-0x00000000054A0000-0x0000000005526000-memory.dmpFilesize
536KB
-
memory/4636-53-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB