Analysis
-
max time kernel
140s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2024 22:44
Behavioral task
behavioral1
Sample
65c970523400a66ed16996da230fa9a6a3121e2d0c29a1699eed80a3d75726ca.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
65c970523400a66ed16996da230fa9a6a3121e2d0c29a1699eed80a3d75726ca.exe
Resource
win10v2004-20240226-en
General
-
Target
65c970523400a66ed16996da230fa9a6a3121e2d0c29a1699eed80a3d75726ca.exe
-
Size
721KB
-
MD5
048066fb558b1e800b7c36d4b7372f6b
-
SHA1
8d8d58db21cb0e4a535d694fa4090f34cddf245b
-
SHA256
65c970523400a66ed16996da230fa9a6a3121e2d0c29a1699eed80a3d75726ca
-
SHA512
25a1fdf2bd89197965f6d69c6190bcac1a1f19d2ca8dece1f909ab19cfef6abcdfc25f12f46f46696d12ebaf1383e02c5b1a97eee07a32f30423867367e12253
-
SSDEEP
12288:DquErHF6xC9D6DmR1J98w4oknqOKw/zTd1RVaHvymUi6rjXrm62iU952aLovi757:arl6kD68JmloO7TdNaPymUi63i62xHLv
Malware Config
Extracted
azorult
http://185.79.156.23/j0n0/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
UPX dump on OEP (original entry point) 2 IoCs
Processes:
resource yara_rule behavioral2/memory/864-0-0x0000000000500000-0x0000000000694000-memory.dmp UPX behavioral2/memory/864-23-0x0000000000500000-0x0000000000694000-memory.dmp UPX -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
65c970523400a66ed16996da230fa9a6a3121e2d0c29a1699eed80a3d75726ca.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation 65c970523400a66ed16996da230fa9a6a3121e2d0c29a1699eed80a3d75726ca.exe -
Processes:
resource yara_rule behavioral2/memory/864-0-0x0000000000500000-0x0000000000694000-memory.dmp upx behavioral2/memory/864-23-0x0000000000500000-0x0000000000694000-memory.dmp upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/864-23-0x0000000000500000-0x0000000000694000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
65c970523400a66ed16996da230fa9a6a3121e2d0c29a1699eed80a3d75726ca.exedescription pid process target process PID 864 set thread context of 4376 864 65c970523400a66ed16996da230fa9a6a3121e2d0c29a1699eed80a3d75726ca.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4012 timeout.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
65c970523400a66ed16996da230fa9a6a3121e2d0c29a1699eed80a3d75726ca.exepid process 864 65c970523400a66ed16996da230fa9a6a3121e2d0c29a1699eed80a3d75726ca.exe 864 65c970523400a66ed16996da230fa9a6a3121e2d0c29a1699eed80a3d75726ca.exe 864 65c970523400a66ed16996da230fa9a6a3121e2d0c29a1699eed80a3d75726ca.exe 864 65c970523400a66ed16996da230fa9a6a3121e2d0c29a1699eed80a3d75726ca.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
65c970523400a66ed16996da230fa9a6a3121e2d0c29a1699eed80a3d75726ca.exepid process 864 65c970523400a66ed16996da230fa9a6a3121e2d0c29a1699eed80a3d75726ca.exe 864 65c970523400a66ed16996da230fa9a6a3121e2d0c29a1699eed80a3d75726ca.exe 864 65c970523400a66ed16996da230fa9a6a3121e2d0c29a1699eed80a3d75726ca.exe 864 65c970523400a66ed16996da230fa9a6a3121e2d0c29a1699eed80a3d75726ca.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
65c970523400a66ed16996da230fa9a6a3121e2d0c29a1699eed80a3d75726ca.execmd.exedescription pid process target process PID 864 wrote to memory of 4376 864 65c970523400a66ed16996da230fa9a6a3121e2d0c29a1699eed80a3d75726ca.exe RegAsm.exe PID 864 wrote to memory of 4376 864 65c970523400a66ed16996da230fa9a6a3121e2d0c29a1699eed80a3d75726ca.exe RegAsm.exe PID 864 wrote to memory of 4376 864 65c970523400a66ed16996da230fa9a6a3121e2d0c29a1699eed80a3d75726ca.exe RegAsm.exe PID 864 wrote to memory of 4376 864 65c970523400a66ed16996da230fa9a6a3121e2d0c29a1699eed80a3d75726ca.exe RegAsm.exe PID 864 wrote to memory of 4376 864 65c970523400a66ed16996da230fa9a6a3121e2d0c29a1699eed80a3d75726ca.exe RegAsm.exe PID 864 wrote to memory of 2828 864 65c970523400a66ed16996da230fa9a6a3121e2d0c29a1699eed80a3d75726ca.exe cmd.exe PID 864 wrote to memory of 2828 864 65c970523400a66ed16996da230fa9a6a3121e2d0c29a1699eed80a3d75726ca.exe cmd.exe PID 864 wrote to memory of 2828 864 65c970523400a66ed16996da230fa9a6a3121e2d0c29a1699eed80a3d75726ca.exe cmd.exe PID 2828 wrote to memory of 4012 2828 cmd.exe timeout.exe PID 2828 wrote to memory of 4012 2828 cmd.exe timeout.exe PID 2828 wrote to memory of 4012 2828 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\65c970523400a66ed16996da230fa9a6a3121e2d0c29a1699eed80a3d75726ca.exe"C:\Users\Admin\AppData\Local\Temp\65c970523400a66ed16996da230fa9a6a3121e2d0c29a1699eed80a3d75726ca.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵PID:4376
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c TimeOut 1 & Del /F "C:\Users\Admin\AppData\Local\Temp\65c970523400a66ed16996da230fa9a6a3121e2d0c29a1699eed80a3d75726ca.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\timeout.exeTimeOut 13⤵
- Delays execution with timeout.exe
PID:4012
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3820 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:81⤵PID:1772
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/864-0-0x0000000000500000-0x0000000000694000-memory.dmpFilesize
1.6MB
-
memory/864-3-0x00000000007A0000-0x00000000007A1000-memory.dmpFilesize
4KB
-
memory/864-23-0x0000000000500000-0x0000000000694000-memory.dmpFilesize
1.6MB
-
memory/4376-4-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4376-12-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4376-14-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4376-16-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4376-18-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4376-20-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4376-22-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB