Overview

overview

10

Static

static

3

2024-09-17...er.exe

windows7-x64

10

2024-09-17...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    94s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-09-2024 18:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe

  • Size

    1.9MB

  • MD5

    640a2b28957aeb7b3147b796a3e9fe57

  • SHA1

    5998e9ec9a3574c62bb73179f5b212b19add2bc0

  • SHA256

    403fe5fca6fe4c90585fbf7533c7755619a5d5455933b5798eaf95b14bd510ed

  • SHA512

    4887f11085ae8ab85258445c1e902eb69901f9cb2720cf8251985662872d83aac150e32bbdb797fd2a6197da2b79a575b06ae70bef37ac403b2fb9d7f9ff7365

  • SSDEEP

    49152:XbwTDIrh3crgiLGBLHTLJRPgMnlsEqSb0q5VWy7EeNL:8TDIrh3crkr5gMnlsEqGPtQAL

Score
10/10
azorultbanloaddiscoverydownloaderdropperevasioninfostealertrojan

Malware Config

Extracted

Family

azorult

C2

http://account.protonvpn.store/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • Banload

    Banload variants download malicious files, then install and execute the files.

    trojandropperdownloaderbanload
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 55 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4220
    • C:\Users\Admin\AppData\Local\Temp\2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2784
      • C:\Users\Admin\AppData\Local\Temp\2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe
        C:\Users\Admin\AppData\Local\Temp\2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe V8
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1672
        • C:\Users\Admin\AppData\Local\Temp\2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe
          C:\Users\Admin\AppData\Local\Temp\2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe V8
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:4260
          • C:\Users\Admin\AppData\Local\Temp\2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe
            "C:\Users\Admin\AppData\Local\Temp\2024-09-17_640a2b28957aeb7b3147b796a3e9fe57_magniber.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4440

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1672-19-0x0000000000400000-0x000000000061D000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/1672-73-0x0000000000400000-0x000000000061D000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2784-3-0x0000000000400000-0x000000000061D000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2784-4-0x0000000002A30000-0x0000000002C3C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2784-11-0x0000000002A30000-0x0000000002C3C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2784-16-0x0000000000400000-0x000000000061D000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2784-17-0x0000000002A30000-0x0000000002C3C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2784-15-0x0000000000400000-0x000000000061D000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2784-14-0x0000000000400000-0x000000000061D000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/2784-21-0x0000000002A30000-0x0000000002C3C000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4220-0-0x0000000000400000-0x000000000061D000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/4220-22-0x0000000000400000-0x000000000061D000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/4260-32-0x0000000000400000-0x000000000061D000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/4260-72-0x00000000029F0000-0x0000000002BFC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4260-28-0x00000000029F0000-0x0000000002BFC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4260-31-0x0000000000400000-0x000000000061D000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/4260-33-0x00000000029F0000-0x0000000002BFC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4260-34-0x00000000029F0000-0x0000000002BFC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4260-25-0x00000000029F0000-0x0000000002BFC000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4260-30-0x0000000000400000-0x000000000061D000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/4440-69-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

    Download

  • memory/4440-67-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

    Download

  • memory/4440-65-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

    Download

  • memory/4440-63-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

    Download

  • memory/4440-39-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

    Download

  • memory/4440-71-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

    Download

  • memory/4440-37-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

    Download

  • memory/4440-75-0x0000000000480000-0x0000000000549000-memory.dmp

    Filesize

    804KB

    Download

  • memory/4440-76-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

    Download