Analysis Overview
SHA256
7c5bd51d549520223a57177f6dde2feea2a8e48077a36d73b1c96701360a68a6
Threat Level: Known bad
The file 528D3EF48415F22BD277A9759D83A859.exe was found to be: Known bad.
Malicious Activity Summary
Azorult
Credentials from Password Stores: Credentials from Web Browsers
Unsecured Credentials: Credentials In Files
Loads dropped DLL
Reads local data of messenger clients
Accesses cryptocurrency files/wallets, possible credential harvesting
Accesses Microsoft Outlook profiles
AutoIT Executable
Suspicious use of SetThreadContext
System Location Discovery: System Language Discovery
Unsigned PE
Program crash
Checks processor information in registry
Delays execution with timeout.exe
Suspicious use of WriteProcessMemory
outlook_win_path
Suspicious behavior: EnumeratesProcesses
Suspicious use of SendNotifyMessage
Suspicious behavior: MapViewOfSection
outlook_office_path
Suspicious use of FindShellTrayWindow
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-08-29 21:41
Signatures
AutoIT Executable
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-08-29 21:41
Reported
2024-08-29 21:43
Platform
win7-20240704-en
Max time kernel
120s
Max time network
126s
Command Line
Signatures
Azorult
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2376 set thread context of 2264 | N/A | C:\Users\Admin\AppData\Local\Temp\528D3EF48415F22BD277A9759D83A859.exe | C:\Windows\SysWOW64\svchost.exe |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\528D3EF48415F22BD277A9759D83A859.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\svchost.exe | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\528D3EF48415F22BD277A9759D83A859.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2376 wrote to memory of 2264 | N/A | C:\Users\Admin\AppData\Local\Temp\528D3EF48415F22BD277A9759D83A859.exe | C:\Windows\SysWOW64\svchost.exe |
| PID 2376 wrote to memory of 2264 | N/A | C:\Users\Admin\AppData\Local\Temp\528D3EF48415F22BD277A9759D83A859.exe | C:\Windows\SysWOW64\svchost.exe |
| PID 2376 wrote to memory of 2264 | N/A | C:\Users\Admin\AppData\Local\Temp\528D3EF48415F22BD277A9759D83A859.exe | C:\Windows\SysWOW64\svchost.exe |
| PID 2376 wrote to memory of 2264 | N/A | C:\Users\Admin\AppData\Local\Temp\528D3EF48415F22BD277A9759D83A859.exe | C:\Windows\SysWOW64\svchost.exe |
| PID 2376 wrote to memory of 2264 | N/A | C:\Users\Admin\AppData\Local\Temp\528D3EF48415F22BD277A9759D83A859.exe | C:\Windows\SysWOW64\svchost.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\528D3EF48415F22BD277A9759D83A859.exe
"C:\Users\Admin\AppData\Local\Temp\528D3EF48415F22BD277A9759D83A859.exe"
C:\Windows\SysWOW64\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\528D3EF48415F22BD277A9759D83A859.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | ln6b9.shop | udp |
| US | 172.67.128.117:80 | ln6b9.shop | tcp |
Files
memory/2376-11-0x00000000001A0000-0x00000000001A4000-memory.dmp
memory/2264-12-0x0000000000400000-0x0000000000420000-memory.dmp
memory/2264-14-0x0000000000400000-0x0000000000420000-memory.dmp
memory/2264-15-0x0000000000400000-0x0000000000420000-memory.dmp
memory/2264-16-0x0000000000400000-0x0000000000420000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-08-29 21:41
Reported
2024-08-29 21:43
Platform
win10v2004-20240802-en
Max time kernel
149s
Max time network
151s
Command Line
Signatures
Azorult
Credentials from Password Stores: Credentials from Web Browsers
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\svchost.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\svchost.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\svchost.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\svchost.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\svchost.exe | N/A |
Reads local data of messenger clients
Unsecured Credentials: Credentials In Files
Accesses Microsoft Outlook profiles
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Windows\SysWOW64\svchost.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook | C:\Windows\SysWOW64\svchost.exe | N/A |
| Key opened | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Windows\SysWOW64\svchost.exe | N/A |
Accesses cryptocurrency files/wallets, possible credential harvesting
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3792 set thread context of 3440 | N/A | C:\Users\Admin\AppData\Local\Temp\528D3EF48415F22BD277A9759D83A859.exe | C:\Windows\SysWOW64\svchost.exe |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\528D3EF48415F22BD277A9759D83A859.exe |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\528D3EF48415F22BD277A9759D83A859.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\svchost.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\cmd.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\timeout.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\528D3EF48415F22BD277A9759D83A859.exe | N/A |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 | C:\Windows\SysWOW64\svchost.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Windows\SysWOW64\svchost.exe | N/A |
Delays execution with timeout.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\timeout.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\svchost.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\svchost.exe | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\528D3EF48415F22BD277A9759D83A859.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\528D3EF48415F22BD277A9759D83A859.exe | N/A |
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
outlook_office_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook | C:\Windows\SysWOW64\svchost.exe | N/A |
outlook_win_path
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook | C:\Windows\SysWOW64\svchost.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\528D3EF48415F22BD277A9759D83A859.exe
"C:\Users\Admin\AppData\Local\Temp\528D3EF48415F22BD277A9759D83A859.exe"
C:\Windows\SysWOW64\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\528D3EF48415F22BD277A9759D83A859.exe"
C:\Users\Admin\AppData\Local\Temp\528D3EF48415F22BD277A9759D83A859.exe
"C:\Users\Admin\AppData\Local\Temp\528D3EF48415F22BD277A9759D83A859.exe"
C:\Windows\SysWOW64\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\528D3EF48415F22BD277A9759D83A859.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3792 -ip 3792
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 704
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "svchost.exe"
C:\Windows\SysWOW64\timeout.exe
C:\Windows\system32\timeout.exe 3
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 67.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | ln6b9.shop | udp |
| US | 104.21.2.6:80 | ln6b9.shop | tcp |
| US | 8.8.8.8:53 | 6.2.21.104.in-addr.arpa | udp |
| US | 104.21.2.6:80 | ln6b9.shop | tcp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 24.139.73.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.229.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 10.27.171.150.in-addr.arpa | udp |
Files
memory/4248-11-0x0000000003D50000-0x0000000003D54000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Clinton
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
C:\Users\Admin\AppData\Local\Temp\prophetesses
| MD5 | fa7e6ed444c613aa118875ae1e02adf9 |
| SHA1 | 36b177d785051150b249159b6a5e8c347a6135e1 |
| SHA256 | aa48cb85a03e1da81574b554d3f4498689cce04c91712514582f94b012ab73a7 |
| SHA512 | 10b0574215e2578b846452378ac99e452351293bf2d8de651fc7e932c79d5cb1608b56b2d323f17a8ed235264be18a92117f39d18ede74a3bd03f6016d215e72 |
memory/3440-25-0x0000000000400000-0x0000000000420000-memory.dmp
memory/3440-27-0x0000000000400000-0x0000000000420000-memory.dmp
memory/3440-28-0x0000000000400000-0x0000000000420000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\ACF0987B\nss3.dll
| MD5 | 556ea09421a0f74d31c4c0a89a70dc23 |
| SHA1 | f739ba9b548ee64b13eb434a3130406d23f836e3 |
| SHA256 | f0e6210d4a0d48c7908d8d1c270449c91eb4523e312a61256833bfeaf699abfb |
| SHA512 | 2481fc80dffa8922569552c3c3ebaef8d0341b80427447a14b291ec39ea62ab9c05a75e85eef5ea7f857488cab1463c18586f9b076e2958c5a314e459045ede2 |
C:\Users\Admin\AppData\Local\Temp\ACF0987B\mozglue.dll
| MD5 | 9e682f1eb98a9d41468fc3e50f907635 |
| SHA1 | 85e0ceca36f657ddf6547aa0744f0855a27527ee |
| SHA256 | 830533bb569594ec2f7c07896b90225006b90a9af108f49d6fb6bebd02428b2d |
| SHA512 | 230230722d61ac1089fabf3f2decfa04f9296498f8e2a2a49b1527797dca67b5a11ab8656f04087acadf873fa8976400d57c77c404eba4aff89d92b9986f32ed |
C:\Users\Admin\AppData\Local\Temp\ACF0987B\vcruntime140.dll
| MD5 | 7587bf9cb4147022cd5681b015183046 |
| SHA1 | f2106306a8f6f0da5afb7fc765cfa0757ad5a628 |
| SHA256 | c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d |
| SHA512 | 0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f |
C:\Users\Admin\AppData\Local\Temp\ACF0987B\msvcp140.dll
| MD5 | 109f0f02fd37c84bfc7508d4227d7ed5 |
| SHA1 | ef7420141bb15ac334d3964082361a460bfdb975 |
| SHA256 | 334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4 |
| SHA512 | 46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39 |
memory/3440-90-0x0000000000400000-0x0000000000420000-memory.dmp
memory/3440-139-0x0000000000400000-0x0000000000420000-memory.dmp