General
-
Target
http://gjg
-
Sample
240414-k8ac2sfd95
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://gjg
Resource
win11-20240412-en
Malware Config
Extracted
Protocol: ftp- Host:
109.248.203.81 - Port:
21 - Username:
alex - Password:
easypassword
Extracted
crimsonrat
185.136.161.124
Extracted
metasploit
encoder/call4_dword_xor
Extracted
azorult
http://boglogov.site/index.php
Targets
-
-
Target
http://gjg
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
CrimsonRAT main payload
-
Detect Lumma Stealer payload V4
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
Modifies security service
-
Modifies visiblity of hidden/system files in Explorer
-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Blocks application from running via registry modification
Adds application to list of disallowed applications.
-
Drops file in Drivers directory
-
Looks for VMWare Tools registry key
-
Modifies Installed Components in the registry
-
Modifies Windows Firewall
-
Sets DLL path for service in the registry
-
Stops running service(s)
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Modifies WinLogon
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Account Manipulation
1Boot or Logon Autostart Execution
5Registry Run Keys / Startup Folder
3Winlogon Helper DLL
2Create or Modify System Process
5Windows Service
5Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Account Manipulation
1Boot or Logon Autostart Execution
5Registry Run Keys / Startup Folder
3Winlogon Helper DLL
2Create or Modify System Process
5Windows Service
5Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1File and Directory Permissions Modification
1Hide Artifacts
3Hidden Files and Directories
3Impair Defenses
6Disable or Modify System Firewall
1Disable or Modify Tools
4Modify Registry
12Virtualization/Sandbox Evasion
1