Analysis
-
max time kernel
24s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09-04-2024 23:27
Behavioral task
behavioral1
Sample
ccad408c7ce69d5e4f2d635c46458202.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ccad408c7ce69d5e4f2d635c46458202.exe
Resource
win10v2004-20240226-en
General
-
Target
ccad408c7ce69d5e4f2d635c46458202.exe
-
Size
2.0MB
-
MD5
ccad408c7ce69d5e4f2d635c46458202
-
SHA1
0c9e336b44a67d65843311bfe8711cd32b965c8c
-
SHA256
818d900af1ef03e94a077f06e6531278ee35f2510439922b8f583e7abb7094f7
-
SHA512
be40f01f9a7d5dfa5967a20d82cb509075be95e4cba0fc69119c7d252a110c4e34e0988a4418243df8afef7642c65d9f4b7f11aaf640941670a2621a00fa8707
-
SSDEEP
24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYO:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9Y0
Malware Config
Extracted
azorult
http://0x21.in:8000/_az/
Extracted
quasar
1.3.0.0
EbayProfiles
5.8.88.191:443
sockartek.icu:443
QSR_MUTEX_0kBRNrRz5TDLEQouI0
-
encryption_key
MWhG6wsClMX8aJM2CVXT
-
install_name
winsock.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
win defender run
-
subdirectory
SubDir
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Quasar payload 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\windef.exe family_quasar behavioral2/memory/2964-31-0x0000000000570000-0x00000000005CE000-memory.dmp family_quasar C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe family_quasar -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ccad408c7ce69d5e4f2d635c46458202.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation ccad408c7ce69d5e4f2d635c46458202.exe -
Executes dropped EXE 3 IoCs
Processes:
vnc.exewindef.exewinsock.exepid process 884 vnc.exe 2964 windef.exe 3232 winsock.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
ccad408c7ce69d5e4f2d635c46458202.exedescription ioc process File opened (read-only) \??\l: ccad408c7ce69d5e4f2d635c46458202.exe File opened (read-only) \??\o: ccad408c7ce69d5e4f2d635c46458202.exe File opened (read-only) \??\s: ccad408c7ce69d5e4f2d635c46458202.exe File opened (read-only) \??\v: ccad408c7ce69d5e4f2d635c46458202.exe File opened (read-only) \??\g: ccad408c7ce69d5e4f2d635c46458202.exe File opened (read-only) \??\h: ccad408c7ce69d5e4f2d635c46458202.exe File opened (read-only) \??\i: ccad408c7ce69d5e4f2d635c46458202.exe File opened (read-only) \??\m: ccad408c7ce69d5e4f2d635c46458202.exe File opened (read-only) \??\p: ccad408c7ce69d5e4f2d635c46458202.exe File opened (read-only) \??\r: ccad408c7ce69d5e4f2d635c46458202.exe File opened (read-only) \??\t: ccad408c7ce69d5e4f2d635c46458202.exe File opened (read-only) \??\x: ccad408c7ce69d5e4f2d635c46458202.exe File opened (read-only) \??\y: ccad408c7ce69d5e4f2d635c46458202.exe File opened (read-only) \??\j: ccad408c7ce69d5e4f2d635c46458202.exe File opened (read-only) \??\k: ccad408c7ce69d5e4f2d635c46458202.exe File opened (read-only) \??\w: ccad408c7ce69d5e4f2d635c46458202.exe File opened (read-only) \??\z: ccad408c7ce69d5e4f2d635c46458202.exe File opened (read-only) \??\a: ccad408c7ce69d5e4f2d635c46458202.exe File opened (read-only) \??\b: ccad408c7ce69d5e4f2d635c46458202.exe File opened (read-only) \??\e: ccad408c7ce69d5e4f2d635c46458202.exe File opened (read-only) \??\n: ccad408c7ce69d5e4f2d635c46458202.exe File opened (read-only) \??\q: ccad408c7ce69d5e4f2d635c46458202.exe File opened (read-only) \??\u: ccad408c7ce69d5e4f2d635c46458202.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 10 ip-api.com -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 svchost.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe autoit_exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
vnc.execcad408c7ce69d5e4f2d635c46458202.exedescription pid process target process PID 884 set thread context of 3748 884 vnc.exe svchost.exe PID 4032 set thread context of 3388 4032 ccad408c7ce69d5e4f2d635c46458202.exe ccad408c7ce69d5e4f2d635c46458202.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1876 3232 WerFault.exe winsock.exe -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 4020 schtasks.exe 2184 schtasks.exe 964 schtasks.exe 5064 schtasks.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
ccad408c7ce69d5e4f2d635c46458202.exepid process 4032 ccad408c7ce69d5e4f2d635c46458202.exe 4032 ccad408c7ce69d5e4f2d635c46458202.exe 4032 ccad408c7ce69d5e4f2d635c46458202.exe 4032 ccad408c7ce69d5e4f2d635c46458202.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
vnc.exepid process 884 vnc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
windef.exedescription pid process Token: SeDebugPrivilege 2964 windef.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
ccad408c7ce69d5e4f2d635c46458202.exevnc.exewindef.exedescription pid process target process PID 4032 wrote to memory of 884 4032 ccad408c7ce69d5e4f2d635c46458202.exe vnc.exe PID 4032 wrote to memory of 884 4032 ccad408c7ce69d5e4f2d635c46458202.exe vnc.exe PID 4032 wrote to memory of 884 4032 ccad408c7ce69d5e4f2d635c46458202.exe vnc.exe PID 884 wrote to memory of 3748 884 vnc.exe svchost.exe PID 884 wrote to memory of 3748 884 vnc.exe svchost.exe PID 4032 wrote to memory of 2964 4032 ccad408c7ce69d5e4f2d635c46458202.exe windef.exe PID 4032 wrote to memory of 2964 4032 ccad408c7ce69d5e4f2d635c46458202.exe windef.exe PID 4032 wrote to memory of 2964 4032 ccad408c7ce69d5e4f2d635c46458202.exe windef.exe PID 884 wrote to memory of 3748 884 vnc.exe svchost.exe PID 4032 wrote to memory of 3388 4032 ccad408c7ce69d5e4f2d635c46458202.exe ccad408c7ce69d5e4f2d635c46458202.exe PID 4032 wrote to memory of 3388 4032 ccad408c7ce69d5e4f2d635c46458202.exe ccad408c7ce69d5e4f2d635c46458202.exe PID 4032 wrote to memory of 3388 4032 ccad408c7ce69d5e4f2d635c46458202.exe ccad408c7ce69d5e4f2d635c46458202.exe PID 4032 wrote to memory of 3388 4032 ccad408c7ce69d5e4f2d635c46458202.exe ccad408c7ce69d5e4f2d635c46458202.exe PID 884 wrote to memory of 3748 884 vnc.exe svchost.exe PID 4032 wrote to memory of 3388 4032 ccad408c7ce69d5e4f2d635c46458202.exe ccad408c7ce69d5e4f2d635c46458202.exe PID 4032 wrote to memory of 2184 4032 ccad408c7ce69d5e4f2d635c46458202.exe schtasks.exe PID 4032 wrote to memory of 2184 4032 ccad408c7ce69d5e4f2d635c46458202.exe schtasks.exe PID 4032 wrote to memory of 2184 4032 ccad408c7ce69d5e4f2d635c46458202.exe schtasks.exe PID 884 wrote to memory of 3748 884 vnc.exe svchost.exe PID 2964 wrote to memory of 964 2964 windef.exe schtasks.exe PID 2964 wrote to memory of 964 2964 windef.exe schtasks.exe PID 2964 wrote to memory of 964 2964 windef.exe schtasks.exe PID 2964 wrote to memory of 3232 2964 windef.exe winsock.exe PID 2964 wrote to memory of 3232 2964 windef.exe winsock.exe PID 2964 wrote to memory of 3232 2964 windef.exe winsock.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ccad408c7ce69d5e4f2d635c46458202.exe"C:\Users\Admin\AppData\Local\Temp\ccad408c7ce69d5e4f2d635c46458202.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵
- Maps connected drives based on registry
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\fkbCBRYVNbYq.bat" "4⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3232 -s 20244⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\ccad408c7ce69d5e4f2d635c46458202.exe"C:\Users\Admin\AppData\Local\Temp\ccad408c7ce69d5e4f2d635c46458202.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeC:\Users\Admin\btpanui\SystemPropertiesPerformance.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3232 -ip 32321⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\windef.exe.logFilesize
1KB
MD510eab9c2684febb5327b6976f2047587
SHA1a12ed54146a7f5c4c580416aecb899549712449e
SHA256f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928
SHA5127e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50
-
C:\Users\Admin\AppData\Local\Temp\fkbCBRYVNbYq.batFilesize
208B
MD54f435bf9718dfb22b26f7ed4be42e957
SHA15b83b3f1da5150748365b365607a33fec3de27d7
SHA25617daa38c48727f3be55a05a1117c39a3a4dce301eb5ee07412b509054d95031d
SHA5126302585245072882ea01e8604d9a6dd2b244b4d0d27bd54906c8dfa138a8cf0c596d984fe8665306550d9c17d463e29919dabe17100a882afd90aa12fbd8cade
-
C:\Users\Admin\AppData\Local\Temp\vnc.exeFilesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
C:\Users\Admin\AppData\Local\Temp\windef.exeFilesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeFilesize
2.0MB
MD524e59e1fe62da0d8be3894e6f791ba20
SHA1173d2b7ccbca402afed3944607c3fe2f6c7163c3
SHA2567d17cef37ac0be039025578758edf10d9817f0b491cc6985ba95126acae393d4
SHA51276a24fcd0b5f5c8646b08dbc62e06c3586afe8409c1e447ac95ca94869167c3fc47733ba33e2900220635d6ce36b1c886c57972120dc27f41f435710d3579de9
-
memory/788-89-0x00000000004D0000-0x000000000056C000-memory.dmpFilesize
624KB
-
memory/788-107-0x00000000004D0000-0x000000000056C000-memory.dmpFilesize
624KB
-
memory/788-84-0x00000000004D0000-0x000000000056C000-memory.dmpFilesize
624KB
-
memory/788-83-0x0000000000570000-0x0000000000571000-memory.dmpFilesize
4KB
-
memory/788-85-0x00000000004D0000-0x000000000056C000-memory.dmpFilesize
624KB
-
memory/2964-45-0x0000000006520000-0x000000000655C000-memory.dmpFilesize
240KB
-
memory/2964-41-0x0000000004EB0000-0x0000000004F42000-memory.dmpFilesize
584KB
-
memory/2964-42-0x0000000004E00000-0x0000000004E10000-memory.dmpFilesize
64KB
-
memory/2964-43-0x0000000005250000-0x00000000052B6000-memory.dmpFilesize
408KB
-
memory/2964-44-0x00000000060E0000-0x00000000060F2000-memory.dmpFilesize
72KB
-
memory/2964-38-0x0000000005330000-0x00000000058D4000-memory.dmpFilesize
5.6MB
-
memory/2964-53-0x0000000073830000-0x0000000073FE0000-memory.dmpFilesize
7.7MB
-
memory/2964-32-0x0000000073830000-0x0000000073FE0000-memory.dmpFilesize
7.7MB
-
memory/2964-31-0x0000000000570000-0x00000000005CE000-memory.dmpFilesize
376KB
-
memory/3068-106-0x0000000073830000-0x0000000073FE0000-memory.dmpFilesize
7.7MB
-
memory/3068-108-0x0000000005830000-0x0000000005840000-memory.dmpFilesize
64KB
-
memory/3068-111-0x0000000073830000-0x0000000073FE0000-memory.dmpFilesize
7.7MB
-
memory/3232-54-0x0000000004C90000-0x0000000004CA0000-memory.dmpFilesize
64KB
-
memory/3232-109-0x0000000073830000-0x0000000073FE0000-memory.dmpFilesize
7.7MB
-
memory/3232-58-0x0000000073830000-0x0000000073FE0000-memory.dmpFilesize
7.7MB
-
memory/3232-56-0x0000000006640000-0x000000000664A000-memory.dmpFilesize
40KB
-
memory/3232-52-0x0000000073830000-0x0000000073FE0000-memory.dmpFilesize
7.7MB
-
memory/3388-34-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3388-20-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3748-57-0x0000000000E00000-0x0000000000E9C000-memory.dmpFilesize
624KB
-
memory/3748-37-0x0000000000E00000-0x0000000000E9C000-memory.dmpFilesize
624KB
-
memory/3748-35-0x0000000000EA0000-0x0000000000EA1000-memory.dmpFilesize
4KB
-
memory/3748-28-0x0000000000E00000-0x0000000000E9C000-memory.dmpFilesize
624KB
-
memory/4032-19-0x0000000004430000-0x0000000004431000-memory.dmpFilesize
4KB
-
memory/4244-100-0x0000000073830000-0x0000000073FE0000-memory.dmpFilesize
7.7MB
-
memory/4244-81-0x0000000005560000-0x0000000005570000-memory.dmpFilesize
64KB
-
memory/4244-80-0x0000000073830000-0x0000000073FE0000-memory.dmpFilesize
7.7MB