Analysis
-
max time kernel
5s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12-09-2024 11:27
Behavioral task
behavioral1
Sample
964221e2d1782fa804dc6e965ee4f920N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
964221e2d1782fa804dc6e965ee4f920N.exe
Resource
win10v2004-20240802-en
General
-
Target
964221e2d1782fa804dc6e965ee4f920N.exe
-
Size
2.0MB
-
MD5
964221e2d1782fa804dc6e965ee4f920
-
SHA1
be0fcc6e0e64cee8bf68ca0f8665b06dc26933e6
-
SHA256
b3c2f56de0655f102fe52ba1aec7369f7a79bf37f563c5f1efe41211d26b2d09
-
SHA512
ab4a683dc080d1c0f5f584a20631255d47e2745305c5e116f89e5cdb636f611fd8cf28b62acca95a8ab4c224a9bc62b21208b81722383323d1357da777305bc6
-
SSDEEP
24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYu:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9Y0
Malware Config
Extracted
azorult
http://0x21.in:8000/_az/
Extracted
quasar
1.3.0.0
EbayProfiles
5.8.88.191:443
sockartek.icu:443
QSR_MUTEX_0kBRNrRz5TDLEQouI0
-
encryption_key
MWhG6wsClMX8aJM2CVXT
-
install_name
winsock.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
win defender run
-
subdirectory
SubDir
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Quasar payload 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\windef.exe family_quasar behavioral2/memory/2600-31-0x0000000000130000-0x000000000018E000-memory.dmp family_quasar C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe family_quasar -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
964221e2d1782fa804dc6e965ee4f920N.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 964221e2d1782fa804dc6e965ee4f920N.exe -
Executes dropped EXE 3 IoCs
Processes:
vnc.exewindef.exewinsock.exepid process 3540 vnc.exe 2600 windef.exe 4532 winsock.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
964221e2d1782fa804dc6e965ee4f920N.exedescription ioc process File opened (read-only) \??\g: 964221e2d1782fa804dc6e965ee4f920N.exe File opened (read-only) \??\i: 964221e2d1782fa804dc6e965ee4f920N.exe File opened (read-only) \??\p: 964221e2d1782fa804dc6e965ee4f920N.exe File opened (read-only) \??\r: 964221e2d1782fa804dc6e965ee4f920N.exe File opened (read-only) \??\s: 964221e2d1782fa804dc6e965ee4f920N.exe File opened (read-only) \??\a: 964221e2d1782fa804dc6e965ee4f920N.exe File opened (read-only) \??\l: 964221e2d1782fa804dc6e965ee4f920N.exe File opened (read-only) \??\o: 964221e2d1782fa804dc6e965ee4f920N.exe File opened (read-only) \??\t: 964221e2d1782fa804dc6e965ee4f920N.exe File opened (read-only) \??\u: 964221e2d1782fa804dc6e965ee4f920N.exe File opened (read-only) \??\z: 964221e2d1782fa804dc6e965ee4f920N.exe File opened (read-only) \??\b: 964221e2d1782fa804dc6e965ee4f920N.exe File opened (read-only) \??\j: 964221e2d1782fa804dc6e965ee4f920N.exe File opened (read-only) \??\k: 964221e2d1782fa804dc6e965ee4f920N.exe File opened (read-only) \??\n: 964221e2d1782fa804dc6e965ee4f920N.exe File opened (read-only) \??\v: 964221e2d1782fa804dc6e965ee4f920N.exe File opened (read-only) \??\y: 964221e2d1782fa804dc6e965ee4f920N.exe File opened (read-only) \??\e: 964221e2d1782fa804dc6e965ee4f920N.exe File opened (read-only) \??\m: 964221e2d1782fa804dc6e965ee4f920N.exe File opened (read-only) \??\q: 964221e2d1782fa804dc6e965ee4f920N.exe File opened (read-only) \??\w: 964221e2d1782fa804dc6e965ee4f920N.exe File opened (read-only) \??\x: 964221e2d1782fa804dc6e965ee4f920N.exe File opened (read-only) \??\h: 964221e2d1782fa804dc6e965ee4f920N.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 12 ip-api.com -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
964221e2d1782fa804dc6e965ee4f920N.exedescription pid process target process PID 2404 set thread context of 3320 2404 964221e2d1782fa804dc6e965ee4f920N.exe 964221e2d1782fa804dc6e965ee4f920N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1804 3540 WerFault.exe vnc.exe 3612 4532 WerFault.exe winsock.exe 1608 4900 WerFault.exe vnc.exe 4772 2100 WerFault.exe winsock.exe -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
964221e2d1782fa804dc6e965ee4f920N.exevnc.exe964221e2d1782fa804dc6e965ee4f920N.exewindef.exeschtasks.exeschtasks.exewinsock.exeschtasks.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 964221e2d1782fa804dc6e965ee4f920N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 964221e2d1782fa804dc6e965ee4f920N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winsock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
Processes:
PING.EXEPING.EXEpid process 2068 PING.EXE 3248 PING.EXE -
Runs ping.exe 1 TTPs 2 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 4044 schtasks.exe 444 schtasks.exe 4968 schtasks.exe 2520 schtasks.exe 4528 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
964221e2d1782fa804dc6e965ee4f920N.exepid process 2404 964221e2d1782fa804dc6e965ee4f920N.exe 2404 964221e2d1782fa804dc6e965ee4f920N.exe 2404 964221e2d1782fa804dc6e965ee4f920N.exe 2404 964221e2d1782fa804dc6e965ee4f920N.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
windef.exewinsock.exedescription pid process Token: SeDebugPrivilege 2600 windef.exe Token: SeDebugPrivilege 4532 winsock.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
winsock.exepid process 4532 winsock.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
964221e2d1782fa804dc6e965ee4f920N.exevnc.exewindef.exewinsock.exedescription pid process target process PID 2404 wrote to memory of 3540 2404 964221e2d1782fa804dc6e965ee4f920N.exe vnc.exe PID 2404 wrote to memory of 3540 2404 964221e2d1782fa804dc6e965ee4f920N.exe vnc.exe PID 2404 wrote to memory of 3540 2404 964221e2d1782fa804dc6e965ee4f920N.exe vnc.exe PID 3540 wrote to memory of 1232 3540 vnc.exe svchost.exe PID 3540 wrote to memory of 1232 3540 vnc.exe svchost.exe PID 2404 wrote to memory of 2600 2404 964221e2d1782fa804dc6e965ee4f920N.exe windef.exe PID 2404 wrote to memory of 2600 2404 964221e2d1782fa804dc6e965ee4f920N.exe windef.exe PID 2404 wrote to memory of 2600 2404 964221e2d1782fa804dc6e965ee4f920N.exe windef.exe PID 3540 wrote to memory of 1232 3540 vnc.exe svchost.exe PID 2404 wrote to memory of 3320 2404 964221e2d1782fa804dc6e965ee4f920N.exe 964221e2d1782fa804dc6e965ee4f920N.exe PID 2404 wrote to memory of 3320 2404 964221e2d1782fa804dc6e965ee4f920N.exe 964221e2d1782fa804dc6e965ee4f920N.exe PID 2404 wrote to memory of 3320 2404 964221e2d1782fa804dc6e965ee4f920N.exe 964221e2d1782fa804dc6e965ee4f920N.exe PID 2404 wrote to memory of 3320 2404 964221e2d1782fa804dc6e965ee4f920N.exe 964221e2d1782fa804dc6e965ee4f920N.exe PID 2404 wrote to memory of 3320 2404 964221e2d1782fa804dc6e965ee4f920N.exe 964221e2d1782fa804dc6e965ee4f920N.exe PID 2404 wrote to memory of 2520 2404 964221e2d1782fa804dc6e965ee4f920N.exe schtasks.exe PID 2404 wrote to memory of 2520 2404 964221e2d1782fa804dc6e965ee4f920N.exe schtasks.exe PID 2404 wrote to memory of 2520 2404 964221e2d1782fa804dc6e965ee4f920N.exe schtasks.exe PID 2600 wrote to memory of 4528 2600 windef.exe schtasks.exe PID 2600 wrote to memory of 4528 2600 windef.exe schtasks.exe PID 2600 wrote to memory of 4528 2600 windef.exe schtasks.exe PID 2600 wrote to memory of 4532 2600 windef.exe winsock.exe PID 2600 wrote to memory of 4532 2600 windef.exe winsock.exe PID 2600 wrote to memory of 4532 2600 windef.exe winsock.exe PID 4532 wrote to memory of 4044 4532 winsock.exe schtasks.exe PID 4532 wrote to memory of 4044 4532 winsock.exe schtasks.exe PID 4532 wrote to memory of 4044 4532 winsock.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\964221e2d1782fa804dc6e965ee4f920N.exe"C:\Users\Admin\AppData\Local\Temp\964221e2d1782fa804dc6e965ee4f920N.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵PID:1232
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 5483⤵
- Program crash
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4528 -
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4044 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dX8rN5jyZIqS.bat" "4⤵PID:5032
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵PID:2700
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2068 -
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"5⤵PID:2100
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f6⤵
- Scheduled Task/Job: Scheduled Task
PID:444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MsmYjntUT5U9.bat" "6⤵PID:5044
-
C:\Windows\SysWOW64\chcp.comchcp 650017⤵PID:1072
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost7⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3248 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 22326⤵
- Program crash
PID:4772 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 19884⤵
- Program crash
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\964221e2d1782fa804dc6e965ee4f920N.exe"C:\Users\Admin\AppData\Local\Temp\964221e2d1782fa804dc6e965ee4f920N.exe"2⤵
- System Location Discovery: System Language Discovery
PID:3320 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2520
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3540 -ip 35401⤵PID:2064
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4532 -ip 45321⤵PID:232
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeC:\Users\Admin\btpanui\SystemPropertiesPerformance.exe1⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵PID:4900
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵PID:1448
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 5203⤵
- Program crash
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵PID:372
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"2⤵PID:3548
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Scheduled Task/Job: Scheduled Task
PID:4968
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4900 -ip 49001⤵PID:2420
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2100 -ip 21001⤵PID:1116
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:4920
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:1936
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD510eab9c2684febb5327b6976f2047587
SHA1a12ed54146a7f5c4c580416aecb899549712449e
SHA256f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928
SHA5127e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50
-
Filesize
208B
MD559b3e6972bfa2eb42f996104f7b46746
SHA14728574e8557f8b417a7f1211e1e0c48b42a1392
SHA2562d28da8182380f18370fe2dd3c01839e36b25a68c882e07979ebe0e30803f95e
SHA512b786ec73e4ab079ffa95418c621ca780ba067049270a1e6564444671184c1c07432a4bfb2790459d0e8bd25e2ac54bd0828710578d30e42915f22e7c302d5bb2
-
Filesize
208B
MD5f51d7af302721a6185bfb6dc8391d0c5
SHA12efae67249a049fc78d958a4fba9690dbc18fd63
SHA2564e57019e0a0e41b4922725bd21c0ca7dc7c0634aaa464cebdd805956336e5fb4
SHA5127de31acdd590a337127d9ca5be9f0bf180c374eea5210f453f16ffe9367cd39b7111d79392fc741b83b3787b921d3e916e0a8cd19e37943c49d098574dca074b
-
Filesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
Filesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
Filesize
224B
MD5217a09caa60abae6ac82d8030bcec267
SHA1762ae97c7b7cc7002e917d228fe189acd5f6bd26
SHA256061a32c15ee75b7060f031cbfbe2431db4d2665636f2d61348d47abf9dc61d7d
SHA512ac8982a67b8a757f1194fdc1958dfcfb566e0adc2affb63ab8173f35a86a23424afe56d1f1f1f99bfbf071521c602fb6d62dd989c85f5d3fe28f7a324dbbd204
-
Filesize
2.0MB
MD560f8e60db7f4bad3f386f6baf4564388
SHA17aa106cafcff2e473b5d897e529005c89464cd01
SHA256335453265e1955a2e5b205b285e7e2f62e689119b2d0041c01d9768ea41706a0
SHA51287768a69c9517565323abe3fa5fa685502bc01c2c20a23ed99b83269212d4175feb7a84b48da3c259af2a775987f8a7894cb9919a5c628daef30f8496aef7da5