Analysis
- max time kernel
93s - max time network
97s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
28/09/2024, 18:35
General
- Target COD 09256214__et__t_, _____st__ 2024_765124.PDF.exe
- Size 629KB
- Sample240928-w8e43sshme
- SHA256 0876a062221ba67194143bb2b1fc83d87b22860cf5e8cff64239b4b9dc251d11
Malware Config
Extracted
-
azorult
-
http://l0h5.shop/CM341/index.php
Signatures
- Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\COD 09256214__et__t_, _____st__ 2024_765124.PDF.exe"C:\Users\Admin\AppData\Local\Temp\COD 09256214__et__t_, _____st__ 2024_765124.PDF.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\COD 09256214__et__t_, _____st__ 2024_765124.PDF.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bzklpXoszJTBl.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bzklpXoszJTBl" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEB4A.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\COD 09256214__et__t_, _____st__ 2024_765124.PDF.exe"C:\Users\Admin\AppData\Local\Temp\COD 09256214__et__t_, _____st__ 2024_765124.PDF.exe"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_vu5x14zv.pgj.ps1
tmpEB4A.tmp
memory/860-49-0x0000000000400000-0x0000000000420000-memory.dmp
memory/860-48-0x0000000000400000-0x0000000000420000-memory.dmp
memory/3684-7-0x0000000007190000-0x000000000720E000-memory.dmp
memory/3684-51-0x0000000074A50000-0x0000000075200000-memory.dmp
memory/3684-8-0x0000000005B60000-0x0000000005B72000-memory.dmp
memory/3684-9-0x0000000074A5E000-0x0000000074A5F000-memory.dmp
memory/3684-10-0x0000000074A50000-0x0000000075200000-memory.dmp
memory/3684-11-0x00000000063F0000-0x0000000006400000-memory.dmp
memory/3684-12-0x0000000007530000-0x0000000007594000-memory.dmp
memory/3684-3-0x0000000005720000-0x00000000057B2000-memory.dmp
memory/3684-6-0x00000000061A0000-0x000000000623C000-memory.dmp
memory/3684-5-0x0000000005900000-0x000000000590A000-memory.dmp
memory/3684-1-0x0000000000C80000-0x0000000000D20000-memory.dmp
memory/3684-2-0x0000000005BF0000-0x0000000006194000-memory.dmp
memory/3684-0-0x0000000074A5E000-0x0000000074A5F000-memory.dmp
memory/3684-4-0x0000000074A50000-0x0000000075200000-memory.dmp
memory/4904-91-0x0000000074A50000-0x0000000075200000-memory.dmp
memory/4904-83-0x00000000075B0000-0x00000000075C4000-memory.dmp
memory/4904-82-0x00000000075A0000-0x00000000075AE000-memory.dmp
memory/4904-31-0x0000000074A50000-0x0000000075200000-memory.dmp
memory/4904-84-0x00000000076B0000-0x00000000076CA000-memory.dmp
memory/4904-81-0x0000000007570000-0x0000000007581000-memory.dmp
memory/4904-47-0x0000000074A50000-0x0000000075200000-memory.dmp
memory/4904-21-0x0000000074A50000-0x0000000075200000-memory.dmp
memory/4904-85-0x0000000007690000-0x0000000007698000-memory.dmp
memory/4904-80-0x00000000075F0000-0x0000000007686000-memory.dmp
memory/4904-67-0x0000000075300000-0x000000007534C000-memory.dmp
memory/5048-34-0x0000000074A50000-0x0000000075200000-memory.dmp
memory/5048-55-0x0000000075300000-0x000000007534C000-memory.dmp
memory/5048-65-0x0000000007430000-0x000000000744E000-memory.dmp
memory/5048-54-0x0000000007470000-0x00000000074A2000-memory.dmp
memory/5048-66-0x00000000074B0000-0x0000000007553000-memory.dmp
memory/5048-53-0x00000000064F0000-0x000000000653C000-memory.dmp
memory/5048-77-0x0000000007E40000-0x00000000084BA000-memory.dmp
memory/5048-78-0x00000000077F0000-0x000000000780A000-memory.dmp
memory/5048-79-0x0000000007850000-0x000000000785A000-memory.dmp
memory/5048-52-0x00000000064D0000-0x00000000064EE000-memory.dmp
memory/5048-33-0x0000000005F40000-0x0000000006294000-memory.dmp
memory/5048-22-0x0000000005510000-0x0000000005532000-memory.dmp
memory/5048-23-0x00000000055B0000-0x0000000005616000-memory.dmp
memory/5048-24-0x0000000005ED0000-0x0000000005F36000-memory.dmp
memory/5048-20-0x0000000074A50000-0x0000000075200000-memory.dmp
memory/5048-18-0x0000000074A50000-0x0000000075200000-memory.dmp
memory/5048-19-0x0000000005730000-0x0000000005D58000-memory.dmp
memory/5048-92-0x0000000074A50000-0x0000000075200000-memory.dmp
memory/5048-17-0x0000000004F50000-0x0000000004F86000-memory.dmp