Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-03-2024 07:20

General

  • Target

    c80898f305c03178e6fb02cf47377dc3.exe

  • Size

    3.1MB

  • MD5

    c80898f305c03178e6fb02cf47377dc3

  • SHA1

    74e0a04ef6d73cfc777f2e92e56ff82a75f1ff25

  • SHA256

    b77d2a8495358e831a2060b1dadf1c74e056b489970f8a3e0fecf48693368dce

  • SHA512

    a7b1cd1c0bc81eaeca2174a0b3caf6de193874506fe2a3da89a15c3376bf31cb3d36b17103b3aed25c10fb7ea8b9683990aa0b45386382124a4878dc7a68baea

  • SSDEEP

    98304:odNIA2b8lIpIta0Icq+KPtYulORjiCSHwdlPtqM7RcS4FIKU21IEfrNdSf8I:odNB4ianUstYuUR2CSHsVP8I

Malware Config

Extracted

Family

netwire

C2

174.127.99.159:7882

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    May-B

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    Password

  • registry_autorun

    false

  • use_mutex

    false

Extracted

Family

azorult

C2

https://gemateknindoperkasa.co.id/imag/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • NetWire RAT payload 3 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c80898f305c03178e6fb02cf47377dc3.exe
    "C:\Users\Admin\AppData\Local\Temp\c80898f305c03178e6fb02cf47377dc3.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1136
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c test.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3676
      • C:\Users\Admin\AppData\Local\Temp\test.exe
        test.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:924
        • C:\Users\Admin\AppData\Local\Temp\File.exe
          "C:\Users\Admin\AppData\Local\Temp\File.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:792
          • C:\Users\Admin\AppData\Roaming\tmp.exe
            "C:\Users\Admin\AppData\Roaming\tmp.exe"
            5⤵
            • Executes dropped EXE
            PID:3340
          • C:\Users\Admin\AppData\Local\Temp\svhost.exe
            "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
            5⤵
            • Executes dropped EXE
            PID:512
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/File.exe" "%temp%\FolderN\name.exe" /Y
            5⤵
              PID:3440
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4692
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f
                6⤵
                  PID:856
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier
                5⤵
                • NTFS ADS
                PID:1828
            • C:\Users\Admin\AppData\Local\Temp\svhost.exe
              "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
              4⤵
              • Executes dropped EXE
              PID:3488
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/test.exe" "%temp%\FolderN\name.exe" /Y
              4⤵
                PID:2184
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:4828
                • C:\Windows\SysWOW64\reg.exe
                  reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f
                  5⤵
                    PID:4196
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier
                  4⤵
                  • NTFS ADS
                  PID:4892

          Network

          MITRE ATT&CK Matrix ATT&CK v13

          Discovery

          Query Registry

          1
          T1012

          System Information Discovery

          2
          T1082

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\File.exe
            Filesize

            342KB

            MD5

            37c82e15058e2f8f5e9525b956e6440d

            SHA1

            3bf20d00bd7a7943c4066d534f5b276cac5ae39f

            SHA256

            80c4716318f874881151c78c4dce9a0a01be4294834f33ee7f12a8a34bb8b2b7

            SHA512

            5c9c37a13cac634771ae18736845b8e7c1a33fd8c6c9ae564f6863b5033a68565f0fd3da555d15870bbc547cc549153c096c44f2d7ced828baffdcfa8641da0a

          • C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe
            Filesize

            64KB

            MD5

            1c267a0b76fcbd7d48f0c8412acaab94

            SHA1

            ff67e0fceba24d8149cd98621883480c395af2cf

            SHA256

            10c30bdbf94a912bc580e9b92fa5a9d6384cec3d1ec8e587d0b2763af0d9b267

            SHA512

            9eee460a3434b84ddb3746661dc24ef3b3391048abb1b2111bd2a3b84c62c5ed5c71b02552b608207c9cef6e123533f6bd619441f97220bed0ab04184b4e787e

          • C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk
            Filesize

            1KB

            MD5

            55ee95b381c06614451d6b598235efba

            SHA1

            3c3c1da621a4352f2846471a518a78b64bcc4fbf

            SHA256

            8437a447ef52cf43db7e01203d6763a9ca789a515a0cf945be7f81a78ac474a3

            SHA512

            bd93e51c27a1f01cd0f0ed6248394f980ad256e39b33fe039ea778f7ee47c92396f175da8ca7d6c8d3e521f3de8eee6fb8f9c2312fc3d7eaf4ace0d79f382e3f

          • C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier
            Filesize

            27B

            MD5

            130a75a932a2fe57bfea6a65b88da8f6

            SHA1

            b66d7530d150d45c0a390bb3c2cd4ca4fc404d1c

            SHA256

            f2b79cae559d6772afc1c2ed9468988178f8b6833d5028a15dea73ce47d0196e

            SHA512

            6cd147c6f3af95803b7b0898e97ec2ed374c1f56a487b50e3d22003a67cec26a6fa12a3920b1b5624bde156f9601469ae3c7b7354fa8cf37be76c84121767eed

          • C:\Users\Admin\AppData\Local\Temp\svhost.exe
            Filesize

            256KB

            MD5

            8fdf47e0ff70c40ed3a17014aeea4232

            SHA1

            e6256a0159688f0560b015da4d967f41cbf8c9bd

            SHA256

            ed9884bac608c06b7057037cc91d90e4ae5f74dd2dbce2af476699c6d4492d82

            SHA512

            bd69d092ed4f9c5e1f24eaf5ec79fb316469d53849dc798fae0fcba5e90869b77ee924c23cc6f692198ff25827ab60ad47bb46cadd6e0aadde7731cbafb013be

          • C:\Users\Admin\AppData\Local\Temp\test.exe
            Filesize

            931KB

            MD5

            836cda1d8a9718485cc9f9653530c2d9

            SHA1

            fca85ff9aa624547d9a315962d82388c300edac1

            SHA256

            d3793a581da66ef5840648574ce364846e7c68a559c0f5e49faf9e4892ecdc72

            SHA512

            07ca078d79f622706d08a534f6b5e2c896152fb0d0e452781fa6be5dc90028fdf074b3b78acac438f2acf5b3f5522e70afb7db4551874a3083860213e2790481

          • C:\Users\Admin\AppData\Roaming\tmp.exe
            Filesize

            112KB

            MD5

            bae2b04e1160950e570661f55d7cd6f8

            SHA1

            f4abc073a091292547dda85d0ba044cab231c8da

            SHA256

            ab0744c19af062c698e94e8eb9ee0e67bcf9a078f53d2a6a848406e2413c4d59

            SHA512

            1bfef1217a6e2ecacee407eed70df9205cbfabb4ddfe06fcc11a7ddf2b42262ec3ab61421474b56b338fa76ffea9beac73530650d39eff61dffcfc25a7fe45b6

          • memory/512-41-0x0000000000400000-0x0000000000420000-memory.dmp
            Filesize

            128KB

          • memory/512-44-0x0000000000400000-0x0000000000420000-memory.dmp
            Filesize

            128KB

          • memory/512-47-0x0000000000400000-0x0000000000420000-memory.dmp
            Filesize

            128KB

          • memory/792-68-0x0000000074900000-0x00000000750B0000-memory.dmp
            Filesize

            7.7MB

          • memory/792-21-0x0000000000ED0000-0x0000000000F2C000-memory.dmp
            Filesize

            368KB

          • memory/792-22-0x0000000074900000-0x00000000750B0000-memory.dmp
            Filesize

            7.7MB

          • memory/792-23-0x0000000003130000-0x0000000003140000-memory.dmp
            Filesize

            64KB

          • memory/792-24-0x0000000003100000-0x0000000003124000-memory.dmp
            Filesize

            144KB

          • memory/924-8-0x0000000004E60000-0x0000000004E70000-memory.dmp
            Filesize

            64KB

          • memory/924-61-0x0000000074900000-0x00000000750B0000-memory.dmp
            Filesize

            7.7MB

          • memory/924-64-0x0000000074900000-0x00000000750B0000-memory.dmp
            Filesize

            7.7MB

          • memory/924-6-0x0000000074900000-0x00000000750B0000-memory.dmp
            Filesize

            7.7MB

          • memory/924-7-0x0000000004D90000-0x0000000004E2C000-memory.dmp
            Filesize

            624KB

          • memory/924-9-0x0000000004E90000-0x0000000004F16000-memory.dmp
            Filesize

            536KB

          • memory/924-62-0x0000000004E60000-0x0000000004E70000-memory.dmp
            Filesize

            64KB

          • memory/924-5-0x00000000002E0000-0x00000000003CE000-memory.dmp
            Filesize

            952KB

          • memory/1136-60-0x0000000000400000-0x0000000000B9E000-memory.dmp
            Filesize

            7.6MB

          • memory/1136-0-0x0000000000400000-0x0000000000B9E000-memory.dmp
            Filesize

            7.6MB

          • memory/1136-66-0x0000000000400000-0x0000000000B9E000-memory.dmp
            Filesize

            7.6MB

          • memory/3340-55-0x0000000000400000-0x0000000000420000-memory.dmp
            Filesize

            128KB

          • memory/3488-31-0x0000000000400000-0x0000000000433000-memory.dmp
            Filesize

            204KB

          • memory/3488-27-0x0000000000400000-0x0000000000433000-memory.dmp
            Filesize

            204KB

          • memory/3488-30-0x0000000000400000-0x0000000000433000-memory.dmp
            Filesize

            204KB