Analysis
-
max time kernel
4s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 12:54
Behavioral task
behavioral1
Sample
3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe
Resource
win10v2004-20241007-en
General
-
Target
3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe
-
Size
2.0MB
-
MD5
3f8d4a67e8e2d15220f4ec2cb0caf28c
-
SHA1
3fb979356e7978bc1663516e9ef93428635dcba3
-
SHA256
3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed
-
SHA512
5445ee21fe04d9772a3af88f31e5706b45d4c32533a9c230f70f66a2d50c637af6d7a43f96a85be68b786562e509a75ac345be92cc7758332a3987aec61f577d
-
SSDEEP
24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYB:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9YL
Malware Config
Extracted
quasar
1.3.0.0
EbayProfiles
5.8.88.191:443
sockartek.icu:443
QSR_MUTEX_0kBRNrRz5TDLEQouI0
-
encryption_key
MWhG6wsClMX8aJM2CVXT
-
install_name
winsock.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
win defender run
-
subdirectory
SubDir
Extracted
azorult
http://0x21.in:8000/_az/
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Azorult family
-
Quasar family
-
Quasar payload 6 IoCs
resource yara_rule behavioral1/files/0x000a000000016d64-17.dat family_quasar behavioral1/memory/2760-56-0x0000000001110000-0x000000000116E000-memory.dmp family_quasar behavioral1/memory/2736-66-0x00000000001E0000-0x000000000023E000-memory.dmp family_quasar behavioral1/files/0x0007000000016fc9-69.dat family_quasar behavioral1/memory/2276-112-0x0000000000CC0000-0x0000000000D1E000-memory.dmp family_quasar behavioral1/memory/2444-138-0x0000000000810000-0x000000000086E000-memory.dmp family_quasar -
Executes dropped EXE 2 IoCs
pid Process 2616 vnc.exe 2760 windef.exe -
Loads dropped DLL 8 IoCs
pid Process 2188 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 2188 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 2188 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 2188 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 2188 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 2188 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 2188 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 2188 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\k: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\u: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\h: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\i: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\j: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\l: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\m: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\n: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\q: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\r: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\b: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\v: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\y: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\s: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\g: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\o: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\p: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\t: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\x: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\a: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\w: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\z: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe File opened (read-only) \??\e: 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 ip-api.com -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 svchost.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x0007000000016fc9-69.dat autoit_exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2188 set thread context of 2220 2188 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 33 PID 2616 set thread context of 2600 2616 vnc.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 1892 2736 WerFault.exe 40 524 2444 WerFault.exe 57 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1896 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1896 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2908 schtasks.exe 2116 schtasks.exe 2576 schtasks.exe 2440 schtasks.exe 2372 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2188 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 2188 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2616 vnc.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2616 2188 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 30 PID 2188 wrote to memory of 2616 2188 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 30 PID 2188 wrote to memory of 2616 2188 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 30 PID 2188 wrote to memory of 2616 2188 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 30 PID 2616 wrote to memory of 2600 2616 vnc.exe 31 PID 2616 wrote to memory of 2600 2616 vnc.exe 31 PID 2616 wrote to memory of 2600 2616 vnc.exe 31 PID 2616 wrote to memory of 2600 2616 vnc.exe 31 PID 2616 wrote to memory of 2600 2616 vnc.exe 31 PID 2188 wrote to memory of 2760 2188 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 32 PID 2188 wrote to memory of 2760 2188 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 32 PID 2188 wrote to memory of 2760 2188 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 32 PID 2188 wrote to memory of 2760 2188 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 32 PID 2188 wrote to memory of 2220 2188 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 33 PID 2188 wrote to memory of 2220 2188 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 33 PID 2188 wrote to memory of 2220 2188 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 33 PID 2188 wrote to memory of 2220 2188 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 33 PID 2188 wrote to memory of 2220 2188 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 33 PID 2188 wrote to memory of 2220 2188 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 33 PID 2616 wrote to memory of 2600 2616 vnc.exe 31 PID 2188 wrote to memory of 2908 2188 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 34 PID 2188 wrote to memory of 2908 2188 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 34 PID 2188 wrote to memory of 2908 2188 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 34 PID 2188 wrote to memory of 2908 2188 3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe 34 PID 2616 wrote to memory of 2600 2616 vnc.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe"C:\Users\Admin\AppData\Local\Temp\3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵
- Maps connected drives based on registry
PID:2600
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2760 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- Scheduled Task/Job: Scheduled Task
PID:2116
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵PID:2736
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
PID:2576
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\6gFGKO2Xlrjq.bat" "4⤵PID:2312
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵PID:2160
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1896
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"5⤵PID:2444
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f6⤵
- Scheduled Task/Job: Scheduled Task
PID:2372
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\JPGAQq9kkhYC.bat" "6⤵PID:2080
-
C:\Windows\SysWOW64\chcp.comchcp 650017⤵PID:2012
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 14486⤵
- Program crash
PID:524
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 15324⤵
- Program crash
PID:1892
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe"C:\Users\Admin\AppData\Local\Temp\3c9ebd2e1f1af4ab2cb896c569abe08902184e79c5eda929c0d662207162a4ed.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2220
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2908
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {34CE71E9-6342-4485-939A-BD2A40284EAD} S-1-5-21-3692679935-4019334568-335155002-1000:BCXRJFKE\Admin:Interactive:[1]1⤵PID:1924
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeC:\Users\Admin\btpanui\SystemPropertiesPerformance.exe2⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"3⤵PID:2960
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k4⤵PID:1700
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"3⤵PID:2276
-
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"3⤵PID:2464
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F3⤵
- Scheduled Task/Job: Scheduled Task
PID:2440
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208B
MD58e9f6fd634803bf4fdcddf07d51aa2a5
SHA16f4e03211addd414870b41db2415c6bb00237f3d
SHA256cdd5f678c080723827133ff86d994d2f014753c890c319ec81306e782d71318b
SHA512a72f3c2dc200fc2930d6dc2c3a8fe1e0077c05a4b1229c5effea72a8395981f1396aa2787f098c7ada19420382f717e610c95b6bb569c4fcf8c7f703619ac027
-
Filesize
208B
MD5d424bdd45d3c93996a3cd12e475218c4
SHA1cd0cac3099079553f908cccfdd3e41276d9cad42
SHA256e38a57ad80d45315ae56c5cd7a35efee6b865dfa0e4db265d6eeb284456a91e3
SHA512bbf86ab44d0a85b94e4c38466454796ca10367685daadef50a6248f8b35e41f8b047cc38462bb0358b11e5c46313baa3dfa5af4cbaa1d9b7a09f6d7e9e331d6e
-
Filesize
224B
MD501c3b0079536117115e6b9730f306ba1
SHA135a4f3f97194eb970032423875dcfa56b684e054
SHA2565733c85df65fcef14127140a476efd1bc36be69aa30f76db97d741333e06f8ef
SHA512addc93c30bf6cc5966ddbbcc72b21b50549884fab1bc323e85b63ff2b25588362fe08ff8ead442df3cf78df7366f03dcb03419afe243e50d47b7cd9fc7a19ed3
-
Filesize
213B
MD5756c0edbf4a81f751131037c9f73f87c
SHA1df6ea07255b3ea79dc5e3854bb68a68ba590d8a3
SHA256f6caee32ec777c4c1e49a6d2a9c995372b32907f4ba722514f81217acd94fe4f
SHA5127b08c6d48d526470f8e20513b38178b256802471b44aefd049a44935669e22517828a619f8f00052233e17524329ebe0c897bb818090c1b26f6d7208d8c6383c
-
Filesize
2.0MB
MD56618ad5c85cf35600761d789310d7582
SHA1adb1393fb88ad5545331571d200a33de36840503
SHA256e1055e5f15d9c385cf02ef0da4d1260deb4e6d8ffb9f329b8988dd2c9b203b0e
SHA5122cf0f73e94c15a1e6987a4426845ba962010d62ac6ca92e90b04b9590754f9f3828e5fe7f60512880e4518c210f5856fb251b5f279cc83ac7195ba46adf0e60e
-
Filesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
Filesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb