Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
27-03-2024 17:07
Behavioral task
behavioral1
Sample
030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe
Resource
win10v2004-20240226-en
General
-
Target
030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe
-
Size
2.0MB
-
MD5
73e14efb895cc9aa2445499f65496c41
-
SHA1
d6ed9fce330f2cd17fcfcd96a89bec86882f3fe3
-
SHA256
030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8
-
SHA512
0fe119ceb610ecc9549ac1e97a7918f30228a5579b7a6a30ced5bcbe2a080c9ab6dd283ce02c0bb774516f97797e4b8bd53327c05fcf4baddf4791843ab62887
-
SSDEEP
24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYn:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9Yh
Malware Config
Extracted
quasar
1.3.0.0
EbayProfiles
5.8.88.191:443
sockartek.icu:443
QSR_MUTEX_0kBRNrRz5TDLEQouI0
-
encryption_key
MWhG6wsClMX8aJM2CVXT
-
install_name
winsock.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
win defender run
-
subdirectory
SubDir
Extracted
azorult
http://0x21.in:8000/_az/
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Quasar payload 4 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\windef.exe family_quasar behavioral1/memory/2648-37-0x0000000000350000-0x00000000003AE000-memory.dmp family_quasar behavioral1/memory/2648-45-0x0000000004AC0000-0x0000000004B00000-memory.dmp family_quasar behavioral1/memory/2696-54-0x0000000000030000-0x000000000008E000-memory.dmp family_quasar -
Detects Windows executables referencing non-Windows User-Agents 3 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\windef.exe INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2648-37-0x0000000000350000-0x00000000003AE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral1/memory/2696-54-0x0000000000030000-0x000000000008E000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Detects executables containing common artifacts observed in infostealers 3 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\windef.exe INDICATOR_SUSPICIOUS_GENInfoStealer behavioral1/memory/2648-37-0x0000000000350000-0x00000000003AE000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer behavioral1/memory/2696-54-0x0000000000030000-0x000000000008E000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer -
Executes dropped EXE 4 IoCs
Processes:
vnc.exewindef.exewinsock.exewinsock.exepid process 2996 vnc.exe 2648 windef.exe 2696 winsock.exe 2192 winsock.exe -
Loads dropped DLL 18 IoCs
Processes:
030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exeWerFault.exewindef.exeWerFault.exepid process 2356 030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe 2356 030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe 2356 030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe 2356 030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe 2356 030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe 2356 030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe 2356 030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe 2356 030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe 2580 WerFault.exe 2580 WerFault.exe 2580 WerFault.exe 2580 WerFault.exe 2648 windef.exe 788 WerFault.exe 788 WerFault.exe 788 WerFault.exe 788 WerFault.exe 788 WerFault.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2580 2996 WerFault.exe vnc.exe 788 2696 WerFault.exe winsock.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1772 schtasks.exe 1604 schtasks.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exepid process 2356 030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe 2356 030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
windef.exewinsock.exedescription pid process Token: SeDebugPrivilege 2648 windef.exe Token: SeDebugPrivilege 2696 winsock.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
winsock.exepid process 2696 winsock.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exevnc.exewindef.exewinsock.execmd.exedescription pid process target process PID 2356 wrote to memory of 2996 2356 030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe vnc.exe PID 2356 wrote to memory of 2996 2356 030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe vnc.exe PID 2356 wrote to memory of 2996 2356 030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe vnc.exe PID 2356 wrote to memory of 2996 2356 030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe vnc.exe PID 2996 wrote to memory of 2600 2996 vnc.exe svchost.exe PID 2996 wrote to memory of 2600 2996 vnc.exe svchost.exe PID 2996 wrote to memory of 2600 2996 vnc.exe svchost.exe PID 2996 wrote to memory of 2600 2996 vnc.exe svchost.exe PID 2996 wrote to memory of 2600 2996 vnc.exe svchost.exe PID 2356 wrote to memory of 2648 2356 030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe windef.exe PID 2356 wrote to memory of 2648 2356 030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe windef.exe PID 2356 wrote to memory of 2648 2356 030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe windef.exe PID 2356 wrote to memory of 2648 2356 030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe windef.exe PID 2356 wrote to memory of 2208 2356 030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe 030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe PID 2356 wrote to memory of 2208 2356 030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe 030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe PID 2356 wrote to memory of 2208 2356 030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe 030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe PID 2356 wrote to memory of 2208 2356 030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe 030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe PID 2356 wrote to memory of 2208 2356 030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe 030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe PID 2996 wrote to memory of 2580 2996 vnc.exe WerFault.exe PID 2996 wrote to memory of 2580 2996 vnc.exe WerFault.exe PID 2996 wrote to memory of 2580 2996 vnc.exe WerFault.exe PID 2996 wrote to memory of 2580 2996 vnc.exe WerFault.exe PID 2648 wrote to memory of 1772 2648 windef.exe schtasks.exe PID 2648 wrote to memory of 1772 2648 windef.exe schtasks.exe PID 2648 wrote to memory of 1772 2648 windef.exe schtasks.exe PID 2648 wrote to memory of 1772 2648 windef.exe schtasks.exe PID 2648 wrote to memory of 2696 2648 windef.exe winsock.exe PID 2648 wrote to memory of 2696 2648 windef.exe winsock.exe PID 2648 wrote to memory of 2696 2648 windef.exe winsock.exe PID 2648 wrote to memory of 2696 2648 windef.exe winsock.exe PID 2696 wrote to memory of 1604 2696 winsock.exe schtasks.exe PID 2696 wrote to memory of 1604 2696 winsock.exe schtasks.exe PID 2696 wrote to memory of 1604 2696 winsock.exe schtasks.exe PID 2696 wrote to memory of 1604 2696 winsock.exe schtasks.exe PID 2696 wrote to memory of 1868 2696 winsock.exe cmd.exe PID 2696 wrote to memory of 1868 2696 winsock.exe cmd.exe PID 2696 wrote to memory of 1868 2696 winsock.exe cmd.exe PID 2696 wrote to memory of 1868 2696 winsock.exe cmd.exe PID 2696 wrote to memory of 788 2696 winsock.exe WerFault.exe PID 2696 wrote to memory of 788 2696 winsock.exe WerFault.exe PID 2696 wrote to memory of 788 2696 winsock.exe WerFault.exe PID 2696 wrote to memory of 788 2696 winsock.exe WerFault.exe PID 1868 wrote to memory of 784 1868 cmd.exe chcp.com PID 1868 wrote to memory of 784 1868 cmd.exe chcp.com PID 1868 wrote to memory of 784 1868 cmd.exe chcp.com PID 1868 wrote to memory of 784 1868 cmd.exe chcp.com PID 1868 wrote to memory of 2948 1868 cmd.exe PING.EXE PID 1868 wrote to memory of 2948 1868 cmd.exe PING.EXE PID 1868 wrote to memory of 2948 1868 cmd.exe PING.EXE PID 1868 wrote to memory of 2948 1868 cmd.exe PING.EXE PID 1868 wrote to memory of 2192 1868 cmd.exe winsock.exe PID 1868 wrote to memory of 2192 1868 cmd.exe winsock.exe PID 1868 wrote to memory of 2192 1868 cmd.exe winsock.exe PID 1868 wrote to memory of 2192 1868 cmd.exe winsock.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe"C:\Users\Admin\AppData\Local\Temp\030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 1603⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\zHhpmQpt0YLJ.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 13644⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe"C:\Users\Admin\AppData\Local\Temp\030e8bc0ca23d5d3aed345683c66c88305287717b58c56a0263463cddbe1c0b8.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\zHhpmQpt0YLJ.batFilesize
208B
MD5a87919a52ad7712a4c6c7dfff53fee47
SHA10507a28ab603a3575c477c203c096f1606889884
SHA25636b506d0b72cc38bc32cb23aad961543d529fbe20b7d72cc81e113cab614ab42
SHA51232258610d2352c51b533720e911cbbd3dcbbb1fb56c47604cf1f5cce6f9ab872cf8eb6125a17b69d1d2d251a287c6da884354a3f2f2f2e8bd6dfa52f79a52e07
-
\Users\Admin\AppData\Local\Temp\vnc.exeFilesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
\Users\Admin\AppData\Local\Temp\windef.exeFilesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
memory/2192-77-0x0000000074490000-0x0000000074B7E000-memory.dmpFilesize
6.9MB
-
memory/2192-76-0x0000000004950000-0x0000000004990000-memory.dmpFilesize
256KB
-
memory/2192-75-0x0000000074490000-0x0000000074B7E000-memory.dmpFilesize
6.9MB
-
memory/2208-28-0x00000000000C0000-0x00000000000E0000-memory.dmpFilesize
128KB
-
memory/2208-31-0x00000000000C0000-0x00000000000E0000-memory.dmpFilesize
128KB
-
memory/2208-39-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/2356-29-0x00000000007D0000-0x00000000007D1000-memory.dmpFilesize
4KB
-
memory/2648-45-0x0000000004AC0000-0x0000000004B00000-memory.dmpFilesize
256KB
-
memory/2648-57-0x0000000074490000-0x0000000074B7E000-memory.dmpFilesize
6.9MB
-
memory/2648-44-0x0000000074490000-0x0000000074B7E000-memory.dmpFilesize
6.9MB
-
memory/2648-37-0x0000000000350000-0x00000000003AE000-memory.dmpFilesize
376KB
-
memory/2696-56-0x00000000049E0000-0x0000000004A20000-memory.dmpFilesize
256KB
-
memory/2696-54-0x0000000000030000-0x000000000008E000-memory.dmpFilesize
376KB
-
memory/2696-59-0x0000000074490000-0x0000000074B7E000-memory.dmpFilesize
6.9MB
-
memory/2696-55-0x0000000074490000-0x0000000074B7E000-memory.dmpFilesize
6.9MB