Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240319-en -
resource tags
arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system -
submitted
26-03-2024 11:34
Behavioral task
behavioral1
Sample
df0fb789d8099c9c9756f2723b165871.exe
Resource
win7-20240319-en
General
-
Target
df0fb789d8099c9c9756f2723b165871.exe
-
Size
3.1MB
-
MD5
df0fb789d8099c9c9756f2723b165871
-
SHA1
54d50a9b9b0901c54d10fe13e3fdc93bd073d6f6
-
SHA256
2d99c983f587910d35aa83bd136d29afea18ad09a0e3af222811918be7747103
-
SHA512
7087342eb8cf908134ca4ce2d42790d13f103f0f7b00a1d465c37fa767c022f42ef4d98a3d4271321ba8ac17b5280761c6a6c19ffbaec91a5dc463f464988fda
-
SSDEEP
98304:adNIA2b8lIpIta0Icq+KPtYulORjiCSHwdlPtqM7RcS4FIKU21IEfrNdSf8x:adNB4ianUstYuUR2CSHsVP8x
Malware Config
Extracted
netwire
174.127.99.159:7882
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
May-B
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Extracted
azorult
https://gemateknindoperkasa.co.id/imag/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
NetWire RAT payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/2664-30-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/2664-32-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/2664-31-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/2664-35-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/2664-47-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/2664-50-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/2664-55-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/2664-91-0x0000000000400000-0x0000000000433000-memory.dmp netwire -
Executes dropped EXE 5 IoCs
Processes:
test.exeFile.exetmp.exesvhost.exesvhost.exepid process 2320 test.exe 2492 File.exe 2556 tmp.exe 2664 svhost.exe 2508 svhost.exe -
Loads dropped DLL 8 IoCs
Processes:
cmd.exetest.exeFile.exepid process 1876 cmd.exe 2320 test.exe 2320 test.exe 2492 File.exe 2492 File.exe 2492 File.exe 2320 test.exe 2492 File.exe -
Processes:
resource yara_rule behavioral1/memory/1932-1-0x0000000000400000-0x0000000000B9D000-memory.dmp upx behavioral1/memory/1932-21-0x0000000000400000-0x0000000000B9D000-memory.dmp upx behavioral1/memory/1932-90-0x0000000000400000-0x0000000000B9D000-memory.dmp upx -
Suspicious use of SetThreadContext 2 IoCs
Processes:
test.exeFile.exedescription pid process target process PID 2320 set thread context of 2664 2320 test.exe svhost.exe PID 2492 set thread context of 2508 2492 File.exe svhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NTFS ADS 2 IoCs
Processes:
cmd.execmd.exedescription ioc process File created C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier cmd.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier cmd.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
test.exeFile.exepid process 2320 test.exe 2492 File.exe 2320 test.exe 2492 File.exe 2320 test.exe 2492 File.exe 2320 test.exe 2492 File.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
test.exeFile.exedescription pid process Token: SeDebugPrivilege 2320 test.exe Token: SeDebugPrivilege 2492 File.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
df0fb789d8099c9c9756f2723b165871.execmd.exetest.exeFile.execmd.exedescription pid process target process PID 1932 wrote to memory of 1876 1932 df0fb789d8099c9c9756f2723b165871.exe cmd.exe PID 1932 wrote to memory of 1876 1932 df0fb789d8099c9c9756f2723b165871.exe cmd.exe PID 1932 wrote to memory of 1876 1932 df0fb789d8099c9c9756f2723b165871.exe cmd.exe PID 1932 wrote to memory of 1876 1932 df0fb789d8099c9c9756f2723b165871.exe cmd.exe PID 1876 wrote to memory of 2320 1876 cmd.exe test.exe PID 1876 wrote to memory of 2320 1876 cmd.exe test.exe PID 1876 wrote to memory of 2320 1876 cmd.exe test.exe PID 1876 wrote to memory of 2320 1876 cmd.exe test.exe PID 1876 wrote to memory of 2320 1876 cmd.exe test.exe PID 1876 wrote to memory of 2320 1876 cmd.exe test.exe PID 1876 wrote to memory of 2320 1876 cmd.exe test.exe PID 2320 wrote to memory of 2492 2320 test.exe File.exe PID 2320 wrote to memory of 2492 2320 test.exe File.exe PID 2320 wrote to memory of 2492 2320 test.exe File.exe PID 2320 wrote to memory of 2492 2320 test.exe File.exe PID 2320 wrote to memory of 2492 2320 test.exe File.exe PID 2320 wrote to memory of 2492 2320 test.exe File.exe PID 2320 wrote to memory of 2492 2320 test.exe File.exe PID 2320 wrote to memory of 2664 2320 test.exe svhost.exe PID 2320 wrote to memory of 2664 2320 test.exe svhost.exe PID 2320 wrote to memory of 2664 2320 test.exe svhost.exe PID 2320 wrote to memory of 2664 2320 test.exe svhost.exe PID 2320 wrote to memory of 2664 2320 test.exe svhost.exe PID 2320 wrote to memory of 2664 2320 test.exe svhost.exe PID 2320 wrote to memory of 2664 2320 test.exe svhost.exe PID 2320 wrote to memory of 2664 2320 test.exe svhost.exe PID 2320 wrote to memory of 2664 2320 test.exe svhost.exe PID 2320 wrote to memory of 2664 2320 test.exe svhost.exe PID 2492 wrote to memory of 2556 2492 File.exe tmp.exe PID 2492 wrote to memory of 2556 2492 File.exe tmp.exe PID 2492 wrote to memory of 2556 2492 File.exe tmp.exe PID 2492 wrote to memory of 2556 2492 File.exe tmp.exe PID 2320 wrote to memory of 2664 2320 test.exe svhost.exe PID 2320 wrote to memory of 2664 2320 test.exe svhost.exe PID 2492 wrote to memory of 2508 2492 File.exe svhost.exe PID 2492 wrote to memory of 2508 2492 File.exe svhost.exe PID 2492 wrote to memory of 2508 2492 File.exe svhost.exe PID 2492 wrote to memory of 2508 2492 File.exe svhost.exe PID 2492 wrote to memory of 2508 2492 File.exe svhost.exe PID 2492 wrote to memory of 2508 2492 File.exe svhost.exe PID 2492 wrote to memory of 2508 2492 File.exe svhost.exe PID 2492 wrote to memory of 2508 2492 File.exe svhost.exe PID 2492 wrote to memory of 2508 2492 File.exe svhost.exe PID 2492 wrote to memory of 2508 2492 File.exe svhost.exe PID 2320 wrote to memory of 680 2320 test.exe cmd.exe PID 2320 wrote to memory of 680 2320 test.exe cmd.exe PID 2320 wrote to memory of 680 2320 test.exe cmd.exe PID 2320 wrote to memory of 680 2320 test.exe cmd.exe PID 2492 wrote to memory of 676 2492 File.exe cmd.exe PID 2492 wrote to memory of 676 2492 File.exe cmd.exe PID 2492 wrote to memory of 676 2492 File.exe cmd.exe PID 2492 wrote to memory of 676 2492 File.exe cmd.exe PID 2320 wrote to memory of 2460 2320 test.exe cmd.exe PID 2320 wrote to memory of 2460 2320 test.exe cmd.exe PID 2320 wrote to memory of 2460 2320 test.exe cmd.exe PID 2320 wrote to memory of 2460 2320 test.exe cmd.exe PID 2460 wrote to memory of 1320 2460 cmd.exe reg.exe PID 2460 wrote to memory of 1320 2460 cmd.exe reg.exe PID 2460 wrote to memory of 1320 2460 cmd.exe reg.exe PID 2460 wrote to memory of 1320 2460 cmd.exe reg.exe PID 2492 wrote to memory of 876 2492 File.exe cmd.exe PID 2492 wrote to memory of 876 2492 File.exe cmd.exe PID 2492 wrote to memory of 876 2492 File.exe cmd.exe PID 2492 wrote to memory of 876 2492 File.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\df0fb789d8099c9c9756f2723b165871.exe"C:\Users\Admin\AppData\Local\Temp\df0fb789d8099c9c9756f2723b165871.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c test.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\test.exetest.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\File.exe"C:\Users\Admin\AppData\Local\Temp\File.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\tmp.exe"C:\Users\Admin\AppData\Roaming\tmp.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/File.exe" "%temp%\FolderN\name.exe" /Y5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f5⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier5⤵
- NTFS ADS
-
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/test.exe" "%temp%\FolderN\name.exe" /Y4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier4⤵
- NTFS ADS
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnkFilesize
947B
MD5d052a7b04b73f8f8487c13e8b6bd6033
SHA1815e659d5edce224bdde53dd770abf4f282b8889
SHA256366143eac3de51862a2dc682ad1dfb96ae0a549645db953fe87318882b3a0cbe
SHA5123f54bd061ec860621c8a66e9a28e0d18e40dba234ae6a8d962c63f7d50cb8454f2a87365c2a82fee3f44c4a09d79645f3187034f36df73d502cbf61a54d3c43b
-
C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.IdentifierMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Temp\File.exeFilesize
342KB
MD537c82e15058e2f8f5e9525b956e6440d
SHA13bf20d00bd7a7943c4066d534f5b276cac5ae39f
SHA25680c4716318f874881151c78c4dce9a0a01be4294834f33ee7f12a8a34bb8b2b7
SHA5125c9c37a13cac634771ae18736845b8e7c1a33fd8c6c9ae564f6863b5033a68565f0fd3da555d15870bbc547cc549153c096c44f2d7ced828baffdcfa8641da0a
-
\Users\Admin\AppData\Local\Temp\svhost.exeFilesize
255KB
MD59af17c8393f0970ee5136bd3ffa27001
SHA14b285b72c1a11285a25f31f2597e090da6bbc049
SHA25671d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019
SHA512b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3
-
\Users\Admin\AppData\Local\Temp\test.exeFilesize
931KB
MD5836cda1d8a9718485cc9f9653530c2d9
SHA1fca85ff9aa624547d9a315962d82388c300edac1
SHA256d3793a581da66ef5840648574ce364846e7c68a559c0f5e49faf9e4892ecdc72
SHA51207ca078d79f622706d08a534f6b5e2c896152fb0d0e452781fa6be5dc90028fdf074b3b78acac438f2acf5b3f5522e70afb7db4551874a3083860213e2790481
-
\Users\Admin\AppData\Roaming\tmp.exeFilesize
112KB
MD5bae2b04e1160950e570661f55d7cd6f8
SHA1f4abc073a091292547dda85d0ba044cab231c8da
SHA256ab0744c19af062c698e94e8eb9ee0e67bcf9a078f53d2a6a848406e2413c4d59
SHA5121bfef1217a6e2ecacee407eed70df9205cbfabb4ddfe06fcc11a7ddf2b42262ec3ab61421474b56b338fa76ffea9beac73530650d39eff61dffcfc25a7fe45b6
-
memory/1932-1-0x0000000000400000-0x0000000000B9D000-memory.dmpFilesize
7.6MB
-
memory/1932-90-0x0000000000400000-0x0000000000B9D000-memory.dmpFilesize
7.6MB
-
memory/1932-21-0x0000000000400000-0x0000000000B9D000-memory.dmpFilesize
7.6MB
-
memory/2320-7-0x0000000004C40000-0x0000000004C80000-memory.dmpFilesize
256KB
-
memory/2320-85-0x0000000004C40000-0x0000000004C80000-memory.dmpFilesize
256KB
-
memory/2320-88-0x0000000073EB0000-0x000000007459E000-memory.dmpFilesize
6.9MB
-
memory/2320-8-0x0000000001250000-0x00000000012D6000-memory.dmpFilesize
536KB
-
memory/2320-84-0x0000000073EB0000-0x000000007459E000-memory.dmpFilesize
6.9MB
-
memory/2320-6-0x0000000073EB0000-0x000000007459E000-memory.dmpFilesize
6.9MB
-
memory/2320-5-0x0000000001330000-0x000000000141E000-memory.dmpFilesize
952KB
-
memory/2492-19-0x0000000000540000-0x0000000000564000-memory.dmpFilesize
144KB
-
memory/2492-18-0x0000000002150000-0x0000000002190000-memory.dmpFilesize
256KB
-
memory/2492-16-0x0000000000C60000-0x0000000000CBC000-memory.dmpFilesize
368KB
-
memory/2492-89-0x0000000073EB0000-0x000000007459E000-memory.dmpFilesize
6.9MB
-
memory/2492-17-0x0000000073EB0000-0x000000007459E000-memory.dmpFilesize
6.9MB
-
memory/2492-87-0x0000000073EB0000-0x000000007459E000-memory.dmpFilesize
6.9MB
-
memory/2508-68-0x0000000000401000-0x000000000041B000-memory.dmpFilesize
104KB
-
memory/2508-59-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2508-52-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2508-54-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2508-67-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2508-57-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2508-61-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2508-64-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2556-83-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2664-55-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2664-50-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2664-30-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2664-27-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2664-32-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2664-25-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2664-47-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2664-45-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/2664-29-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2664-35-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2664-31-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2664-91-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB