Analysis
-
max time kernel
138s -
max time network
130s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
30-06-2020 12:45
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Purchase Order.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
Purchase Order.exe
-
Size
248KB
-
MD5
47d75d97c84b7f0381f7397c2234ac07
-
SHA1
c8d49410da62c0e7dd37b5f6403b03be0eb71857
-
SHA256
5d21ac6bca0ba98cba5930bc0ad3bc702615c3169f8fd73535f920adb8f547b3
-
SHA512
f506c875b97f7693eecaa9a03dcf8b3e9ad98c809bda1e45599e052331b80df4ee3b9a79b64f2347d6f61bdfde95f647a1389922ac6afb6ff87ce1e55c9c3f14
Score
10/10
Malware Config
Extracted
Family
azorult
C2
https://www.nirjhara.com/mine/32/index.php
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Purchase Order.exedescription pid process Token: SeDebugPrivilege 3656 Purchase Order.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
Purchase Order.exedescription pid process target process PID 3656 wrote to memory of 420 3656 Purchase Order.exe Purchase Order.exe PID 3656 wrote to memory of 420 3656 Purchase Order.exe Purchase Order.exe PID 3656 wrote to memory of 420 3656 Purchase Order.exe Purchase Order.exe PID 3656 wrote to memory of 420 3656 Purchase Order.exe Purchase Order.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Purchase Order.exepid process 3656 Purchase Order.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Purchase Order.exedescription pid process target process PID 3656 set thread context of 420 3656 Purchase Order.exe Purchase Order.exe -
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"Purchase Order.exe"2⤵