azorult | 371c309bc8395db6872fa594924b8cfd8a43fc573e20b5b447da709415452534

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
30-08-2024 02:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

march order lists-xlxs.exe
Size

941KB
MD5

fd76f57eaf3745563f1bc04c48b55576
SHA1

81654506e9ac750e0377d7c4a8387078bd0308cf
SHA256

4c70825b33469b490665bf6567dbce4df3f09a223f8c762090a355cee0a6b042
SHA512

05512e3bc1ad14f0f93861c9d82886b132785401d1bedcffe0f70d429f0be752053da3e17279f3e432dfa944c4f52ef5e0b263b98d6726da0b5d46ee3dcb118f
SSDEEP

12288:AG7tVVlLGUr0DVEX1UsfqdsPjbNdmBixEHqa4sQbR8W6szcfG6JS+9xJ1NyC:LdsEFaoMpQd8W3zqG6g+3J5

Score

10^/10

azorult netwire botnet defense_evasion discovery infostealer rat stealer trojan

Malware Config

Extracted

Family

netwire

185.244.30.245:3443

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
FEB9-1
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
Password
registry_autorun
false
use_mutex
false

Extracted

Family

azorult

https://gemateknindoperkasa.co.id/imag/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

NetWire RAT payload 5 IoCs

rat

resource	yara_rule
behavioral1/memory/2616-41-0x0000000000400000-0x000000000042B000-memory.dmp	netwire
behavioral1/memory/2616-38-0x0000000000400000-0x000000000042B000-memory.dmp	netwire
behavioral1/memory/2616-36-0x0000000000400000-0x000000000042B000-memory.dmp	netwire
behavioral1/memory/2616-34-0x0000000000400000-0x000000000042B000-memory.dmp	netwire
behavioral1/memory/2616-43-0x0000000000400000-0x000000000042B000-memory.dmp	netwire

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

Executes dropped EXE 4 IoCs

pid	Process
1452	File.exe
2616	svhost.exe
1448	tmp.exe
1964	svhost.exe

Loads dropped DLL 7 IoCs

pid	Process
2964	march order lists-xlxs.exe
2964	march order lists-xlxs.exe
2964	march order lists-xlxs.exe
1452	File.exe
1452	File.exe
1452	File.exe
1452	File.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2964 set thread context of 2616	2964	march order lists-xlxs.exe	42
PID 1452 set thread context of 1964	1452	File.exe	47

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	march order lists-xlxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	File.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe:Zone.Identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2964	march order lists-xlxs.exe
1452	File.exe
2964	march order lists-xlxs.exe
1452	File.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2964	march order lists-xlxs.exe
Token: 33	2964	march order lists-xlxs.exe
Token: SeIncBasePriorityPrivilege	2964	march order lists-xlxs.exe
Token: SeDebugPrivilege	1452	File.exe
Token: 33	1452	File.exe
Token: SeIncBasePriorityPrivilege	1452	File.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 1452	2964	march order lists-xlxs.exe	30
PID 2964 wrote to memory of 1452	2964	march order lists-xlxs.exe	30
PID 2964 wrote to memory of 1452	2964	march order lists-xlxs.exe	30
PID 2964 wrote to memory of 1452	2964	march order lists-xlxs.exe	30
PID 2964 wrote to memory of 1452	2964	march order lists-xlxs.exe	30
PID 2964 wrote to memory of 1452	2964	march order lists-xlxs.exe	30
PID 2964 wrote to memory of 1452	2964	march order lists-xlxs.exe	30
PID 2964 wrote to memory of 3020	2964	march order lists-xlxs.exe	31
PID 2964 wrote to memory of 3020	2964	march order lists-xlxs.exe	31
PID 2964 wrote to memory of 3020	2964	march order lists-xlxs.exe	31
PID 2964 wrote to memory of 3020	2964	march order lists-xlxs.exe	31
PID 2964 wrote to memory of 3052	2964	march order lists-xlxs.exe	33
PID 2964 wrote to memory of 3052	2964	march order lists-xlxs.exe	33
PID 2964 wrote to memory of 3052	2964	march order lists-xlxs.exe	33
PID 2964 wrote to memory of 3052	2964	march order lists-xlxs.exe	33
PID 3052 wrote to memory of 2804	3052	cmd.exe	35
PID 3052 wrote to memory of 2804	3052	cmd.exe	35
PID 3052 wrote to memory of 2804	3052	cmd.exe	35
PID 3052 wrote to memory of 2804	3052	cmd.exe	35
PID 1452 wrote to memory of 2800	1452	File.exe	36
PID 1452 wrote to memory of 2800	1452	File.exe	36
PID 1452 wrote to memory of 2800	1452	File.exe	36
PID 1452 wrote to memory of 2800	1452	File.exe	36
PID 2964 wrote to memory of 2832	2964	march order lists-xlxs.exe	38
PID 2964 wrote to memory of 2832	2964	march order lists-xlxs.exe	38
PID 2964 wrote to memory of 2832	2964	march order lists-xlxs.exe	38
PID 2964 wrote to memory of 2832	2964	march order lists-xlxs.exe	38
PID 1452 wrote to memory of 2596	1452	File.exe	39
PID 1452 wrote to memory of 2596	1452	File.exe	39
PID 1452 wrote to memory of 2596	1452	File.exe	39
PID 1452 wrote to memory of 2596	1452	File.exe	39
PID 2964 wrote to memory of 2616	2964	march order lists-xlxs.exe	42
PID 2964 wrote to memory of 2616	2964	march order lists-xlxs.exe	42
PID 2964 wrote to memory of 2616	2964	march order lists-xlxs.exe	42
PID 2964 wrote to memory of 2616	2964	march order lists-xlxs.exe	42
PID 2964 wrote to memory of 2616	2964	march order lists-xlxs.exe	42
PID 2964 wrote to memory of 2616	2964	march order lists-xlxs.exe	42
PID 2964 wrote to memory of 2616	2964	march order lists-xlxs.exe	42
PID 2964 wrote to memory of 2616	2964	march order lists-xlxs.exe	42
PID 2964 wrote to memory of 2616	2964	march order lists-xlxs.exe	42
PID 2964 wrote to memory of 2616	2964	march order lists-xlxs.exe	42
PID 2964 wrote to memory of 2616	2964	march order lists-xlxs.exe	42
PID 2596 wrote to memory of 2584	2596	cmd.exe	43
PID 2596 wrote to memory of 2584	2596	cmd.exe	43
PID 2596 wrote to memory of 2584	2596	cmd.exe	43
PID 2596 wrote to memory of 2584	2596	cmd.exe	43
PID 1452 wrote to memory of 2248	1452	File.exe	44
PID 1452 wrote to memory of 2248	1452	File.exe	44
PID 1452 wrote to memory of 2248	1452	File.exe	44
PID 1452 wrote to memory of 2248	1452	File.exe	44
PID 1452 wrote to memory of 1448	1452	File.exe	46
PID 1452 wrote to memory of 1448	1452	File.exe	46
PID 1452 wrote to memory of 1448	1452	File.exe	46
PID 1452 wrote to memory of 1448	1452	File.exe	46
PID 1452 wrote to memory of 1964	1452	File.exe	47
PID 1452 wrote to memory of 1964	1452	File.exe	47
PID 1452 wrote to memory of 1964	1452	File.exe	47
PID 1452 wrote to memory of 1964	1452	File.exe	47
PID 1452 wrote to memory of 1964	1452	File.exe	47
PID 1452 wrote to memory of 1964	1452	File.exe	47
PID 1452 wrote to memory of 1964	1452	File.exe	47
PID 1452 wrote to memory of 1964	1452	File.exe	47
PID 1452 wrote to memory of 1964	1452	File.exe	47
PID 1452 wrote to memory of 1964	1452	File.exe	47

C:\Users\Admin\AppData\Local\Temp\march order lists-xlxs.exe
"C:\Users\Admin\AppData\Local\Temp\march order lists-xlxs.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Users\Admin\AppData\Local\Temp\File.exe
  "C:\Users\Admin\AppData\Local\Temp\File.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/File.exe" "%temp%\FolderN\name.exe" /Y
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2800
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2584
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier
    3⤵
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - System Location Discovery: System Language Discovery
    - NTFS ADS
    PID:2248
- - C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1448
- - C:\Users\Admin\AppData\Local\Temp\svhost.exe
    "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1964
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:/Users/Admin/AppData/Local/Temp/march order lists-xlxs.exe" "%temp%\FolderN\name.exe" /Y
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3020
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%temp%\FolderN\name.exe.lnk" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2804
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %temp%\FolderN\name.exe:Zone.Identifier
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:2832
- C:\Users\Admin\AppData\Local\Temp\svhost.exe
  "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\File.exe

Filesize
518KB

MD5
af89af4000c5ce1ab950555691e0cafe

SHA1
cccbfd7a0d06b9bfcaa7dc998bdd11bdb908544d

SHA256
113076d9de3c2c59c62c67c1ad5c1401295ff69e8764d2140150d735b06d5035

SHA512
2bb4e85323c1a18aba78d89fc6c7b044bc7342d6f1fbdbe19d524419797007d3cef77accc91dfbe33ce5c4ef70e8917060a2fc6a56828615b23ab2f97c79a542

Download Submit
C:\Users\Admin\AppData\Local\Temp\FolderN\name.exe.lnk

Filesize
951B

MD5
d80d6311cf4bfc3f68c9a41ed0621967

SHA1
d92161cacece324b14715ff7760f79380912aa45

SHA256
d3ddb8fc79eb3f860c4b265b6480a7239fb6f047e631940db18da8736310747c

SHA512
15a2983eb3203e79865ddbdee334c0ee42ca7801753ff13b6d505bbb83dcb6c5cf58a1bea30848604722fe6c9b54ad45cf63981f27b6d05d5f41e6500461054d

Download Submit
C:\Users\Admin\AppData\Local\Temp\svhost.exe

Filesize
255KB

MD5
9af17c8393f0970ee5136bd3ffa27001

SHA1
4b285b72c1a11285a25f31f2597e090da6bbc049

SHA256
71d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019

SHA512
b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3

Download Submit
\Users\Admin\AppData\Local\Temp\tmp.exe

Filesize
112KB

MD5
bae2b04e1160950e570661f55d7cd6f8

SHA1
f4abc073a091292547dda85d0ba044cab231c8da

SHA256
ab0744c19af062c698e94e8eb9ee0e67bcf9a078f53d2a6a848406e2413c4d59

SHA512
1bfef1217a6e2ecacee407eed70df9205cbfabb4ddfe06fcc11a7ddf2b42262ec3ab61421474b56b338fa76ffea9beac73530650d39eff61dffcfc25a7fe45b6

Download Submit
memory/1448-74-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1452-79-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/1452-77-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/1452-12-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/1452-11-0x00000000011D0000-0x0000000001256000-memory.dmp

Filesize
536KB

Download
memory/1452-13-0x00000000004E0000-0x0000000000502000-memory.dmp

Filesize
136KB

Download
memory/1452-14-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/1964-68-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1964-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1964-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1964-64-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1964-66-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1964-70-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1964-71-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1964-73-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2616-38-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2616-32-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2616-43-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2616-28-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2616-40-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2616-36-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2616-41-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2616-34-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2616-30-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2964-0-0x000000007455E000-0x000000007455F000-memory.dmp

Filesize
4KB

Download
memory/2964-3-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/2964-75-0x000000007455E000-0x000000007455F000-memory.dmp

Filesize
4KB

Download
memory/2964-76-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/2964-2-0x00000000048A0000-0x0000000004946000-memory.dmp

Filesize
664KB

Download
memory/2964-78-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/2964-1-0x00000000001B0000-0x00000000002A0000-memory.dmp

Filesize
960KB

Download