Analysis

  • max time kernel
    93s
  • max time network
    203s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/01/2025, 16:30

General

  • Target

    24010-KAPSON.exe

  • Size

    927KB

  • MD5

    21c5e6a566f4f22671bd4933ab0dce66

  • SHA1

    764dcbf2aaa25271833bfe217594e07bf4bb9e93

  • SHA256

    1112d16470efe5c9714789944abe3dd43665d9b1f3a206b5d15406e6ab0ef414

  • SHA512

    ae7d18770a9a12077f33c2657b9ea852dbb4cf11f759be0064046c40866ce1f49f20d32737934b75694ee1e55fe479121ee5434d9d35628c3a0a1cdf12a8648b

  • SSDEEP

    24576:juA8Xd6qZNpie53Kl6RJNBIQll+hQT2jiux5J:RKdkec0RFIQlluQsxD

Malware Config

Extracted

Family

azorult

C2

http://b2csa.icu/PL341/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Azorult family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Loads dropped DLL 7 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Blocklisted process makes network request 3 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\24010-KAPSON.exe
    "C:\Users\Admin\AppData\Local\Temp\24010-KAPSON.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:796
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -windowstyle hidden "$Mbps=gc -raw 'C:\Users\Admin\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Deleaves.Sko';$Dybereliggende203=$Mbps.SubString(76135,3);.$Dybereliggende203($Mbps) "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4564
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\SysWOW64\msiexec.exe"
        3⤵
        • Loads dropped DLL
        • Accesses Microsoft Outlook profiles
        • Blocklisted process makes network request
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        • outlook_office_path
        • outlook_win_path
        PID:3120
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "msiexec.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4300
          • C:\Windows\SysWOW64\timeout.exe
            C:\Windows\system32\timeout.exe 3
            5⤵
            • System Location Discovery: System Language Discovery
            • Delays execution with timeout.exe
            PID:1688

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Deleaves.Sko

    Filesize

    74KB

    MD5

    4f6a4d9161aa1dd1ea0a44a1e6c788fe

    SHA1

    c17ee8277755bb04e4c477521d9fd70f9e3f9e21

    SHA256

    07425814d63de0cc304ecb7a7722d35eaa2db0844388112df43c284b89fb4e09

    SHA512

    e5272f9417eceb11ad256801e3380c53dc4fe17b886afb35456a22a30dc6cf5dc7bb64e8f69958577546c1bd14d88377fa4e9c52d63b07c4ddb999dd99cf7214

  • C:\Users\Admin\AppData\Local\Ramtils\Formaldehyds\tyngdepunkterne\Rntgenstraaler118.Sar

    Filesize

    326KB

    MD5

    c49331cc8c53164ccf069bace58eff38

    SHA1

    46b8451d105e7978ccd27313fdaca86c2a5e3e1e

    SHA256

    89216dce9377273dc3a275c707d7b8000aca2432d612e5bb0f3bdf01685542c3

    SHA512

    baf34acb5786134d759954c2ef4445484c605212be3f83956aaff6895b8ce8cbf8e587e6939fcd474d3ce8d0242f9f564290a0640b0ea8558693800606acd855

  • C:\Users\Admin\AppData\Local\Temp\AA4E28D9\mozglue.dll

    Filesize

    135KB

    MD5

    9e682f1eb98a9d41468fc3e50f907635

    SHA1

    85e0ceca36f657ddf6547aa0744f0855a27527ee

    SHA256

    830533bb569594ec2f7c07896b90225006b90a9af108f49d6fb6bebd02428b2d

    SHA512

    230230722d61ac1089fabf3f2decfa04f9296498f8e2a2a49b1527797dca67b5a11ab8656f04087acadf873fa8976400d57c77c404eba4aff89d92b9986f32ed

  • C:\Users\Admin\AppData\Local\Temp\AA4E28D9\msvcp140.dll

    Filesize

    429KB

    MD5

    109f0f02fd37c84bfc7508d4227d7ed5

    SHA1

    ef7420141bb15ac334d3964082361a460bfdb975

    SHA256

    334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

    SHA512

    46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

  • C:\Users\Admin\AppData\Local\Temp\AA4E28D9\nss3.dll

    Filesize

    1.2MB

    MD5

    556ea09421a0f74d31c4c0a89a70dc23

    SHA1

    f739ba9b548ee64b13eb434a3130406d23f836e3

    SHA256

    f0e6210d4a0d48c7908d8d1c270449c91eb4523e312a61256833bfeaf699abfb

    SHA512

    2481fc80dffa8922569552c3c3ebaef8d0341b80427447a14b291ec39ea62ab9c05a75e85eef5ea7f857488cab1463c18586f9b076e2958c5a314e459045ede2

  • C:\Users\Admin\AppData\Local\Temp\AA4E28D9\vcruntime140.dll

    Filesize

    81KB

    MD5

    7587bf9cb4147022cd5681b015183046

    SHA1

    f2106306a8f6f0da5afb7fc765cfa0757ad5a628

    SHA256

    c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

    SHA512

    0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_osbjwiym.lkt.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\nslAEEE.tmp\nsExec.dll

    Filesize

    6KB

    MD5

    51e63a9c5d6d230ef1c421b2eccd45dc

    SHA1

    c499cdad5c613d71ed3f7e93360f1bbc5748c45d

    SHA256

    cd8496a3802378391ec425dec424a14f5d30e242f192ec4eb022d767f9a2480f

    SHA512

    c23d713c3c834b3397c2a199490aed28f28d21f5781205c24df5e1e32365985c8a55be58f06979df09222740ffa51f4da764ebc3d912cd0c9d56ab6a33cab522

  • memory/3120-79-0x00000000002F0000-0x0000000000317000-memory.dmp

    Filesize

    156KB

  • memory/3120-78-0x0000000000840000-0x0000000001A94000-memory.dmp

    Filesize

    18.3MB

  • memory/3120-196-0x0000000000840000-0x0000000001A94000-memory.dmp

    Filesize

    18.3MB

  • memory/3120-147-0x0000000000840000-0x0000000001A94000-memory.dmp

    Filesize

    18.3MB

  • memory/4564-53-0x0000000073DD0000-0x0000000074580000-memory.dmp

    Filesize

    7.7MB

  • memory/4564-58-0x0000000007F70000-0x0000000007F8A000-memory.dmp

    Filesize

    104KB

  • memory/4564-29-0x0000000005BC0000-0x0000000005F14000-memory.dmp

    Filesize

    3.3MB

  • memory/4564-31-0x0000000006270000-0x00000000062BC000-memory.dmp

    Filesize

    304KB

  • memory/4564-30-0x0000000006220000-0x000000000623E000-memory.dmp

    Filesize

    120KB

  • memory/4564-32-0x0000000007220000-0x00000000072B6000-memory.dmp

    Filesize

    600KB

  • memory/4564-33-0x0000000006740000-0x000000000675A000-memory.dmp

    Filesize

    104KB

  • memory/4564-34-0x0000000006760000-0x0000000006782000-memory.dmp

    Filesize

    136KB

  • memory/4564-35-0x0000000007880000-0x0000000007E24000-memory.dmp

    Filesize

    5.6MB

  • memory/4564-37-0x00000000084B0000-0x0000000008B2A000-memory.dmp

    Filesize

    6.5MB

  • memory/4564-40-0x0000000070250000-0x000000007029C000-memory.dmp

    Filesize

    304KB

  • memory/4564-39-0x0000000073DD0000-0x0000000074580000-memory.dmp

    Filesize

    7.7MB

  • memory/4564-50-0x0000000007670000-0x000000000768E000-memory.dmp

    Filesize

    120KB

  • memory/4564-38-0x0000000007630000-0x0000000007662000-memory.dmp

    Filesize

    200KB

  • memory/4564-51-0x0000000073DD0000-0x0000000074580000-memory.dmp

    Filesize

    7.7MB

  • memory/4564-52-0x00000000076A0000-0x0000000007743000-memory.dmp

    Filesize

    652KB

  • memory/4564-17-0x0000000073DD0000-0x0000000074580000-memory.dmp

    Filesize

    7.7MB

  • memory/4564-54-0x00000000077A0000-0x00000000077AA000-memory.dmp

    Filesize

    40KB

  • memory/4564-55-0x00000000077C0000-0x00000000077D1000-memory.dmp

    Filesize

    68KB

  • memory/4564-56-0x0000000007800000-0x000000000780E000-memory.dmp

    Filesize

    56KB

  • memory/4564-57-0x0000000007810000-0x0000000007824000-memory.dmp

    Filesize

    80KB

  • memory/4564-16-0x00000000051E0000-0x0000000005202000-memory.dmp

    Filesize

    136KB

  • memory/4564-59-0x0000000007840000-0x0000000007848000-memory.dmp

    Filesize

    32KB

  • memory/4564-60-0x0000000007F70000-0x0000000007F9A000-memory.dmp

    Filesize

    168KB

  • memory/4564-61-0x0000000007FA0000-0x0000000007FC4000-memory.dmp

    Filesize

    144KB

  • memory/4564-62-0x0000000073DD0000-0x0000000074580000-memory.dmp

    Filesize

    7.7MB

  • memory/4564-64-0x0000000073DD0000-0x0000000074580000-memory.dmp

    Filesize

    7.7MB

  • memory/4564-66-0x0000000073DDE000-0x0000000073DDF000-memory.dmp

    Filesize

    4KB

  • memory/4564-67-0x0000000073DD0000-0x0000000074580000-memory.dmp

    Filesize

    7.7MB

  • memory/4564-68-0x0000000073DD0000-0x0000000074580000-memory.dmp

    Filesize

    7.7MB

  • memory/4564-71-0x0000000073DD0000-0x0000000074580000-memory.dmp

    Filesize

    7.7MB

  • memory/4564-69-0x0000000008B30000-0x000000000B48D000-memory.dmp

    Filesize

    41.4MB

  • memory/4564-70-0x0000000073DD0000-0x0000000074580000-memory.dmp

    Filesize

    7.7MB

  • memory/4564-72-0x0000000073DD0000-0x0000000074580000-memory.dmp

    Filesize

    7.7MB

  • memory/4564-73-0x0000000073DD0000-0x0000000074580000-memory.dmp

    Filesize

    7.7MB

  • memory/4564-74-0x0000000073DD0000-0x0000000074580000-memory.dmp

    Filesize

    7.7MB

  • memory/4564-18-0x0000000005AE0000-0x0000000005B46000-memory.dmp

    Filesize

    408KB

  • memory/4564-19-0x0000000005B50000-0x0000000005BB6000-memory.dmp

    Filesize

    408KB

  • memory/4564-15-0x0000000005440000-0x0000000005A68000-memory.dmp

    Filesize

    6.2MB

  • memory/4564-14-0x0000000073DD0000-0x0000000074580000-memory.dmp

    Filesize

    7.7MB

  • memory/4564-13-0x00000000028A0000-0x00000000028D6000-memory.dmp

    Filesize

    216KB

  • memory/4564-12-0x0000000073DDE000-0x0000000073DDF000-memory.dmp

    Filesize

    4KB

  • memory/4564-75-0x0000000073DD0000-0x0000000074580000-memory.dmp

    Filesize

    7.7MB

  • memory/4564-77-0x0000000073DD0000-0x0000000074580000-memory.dmp

    Filesize

    7.7MB