Analysis
-
max time kernel
135s -
max time network
50s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
08-07-2020 06:09
Static task
static1
Behavioral task
behavioral1
Sample
1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe
Resource
win7
Behavioral task
behavioral2
Sample
1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe
Resource
win10v200430
General
-
Target
1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe
-
Size
623KB
-
MD5
c547dc9b16fab08be2031db5d1d4b115
-
SHA1
8dd7522d227d1a7e65dbdff56ec3b0ec622645fe
-
SHA256
1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd
-
SHA512
71648b7ec372a364262b26c8d1532eadccbf7d00ac2fe58ce303a59d401e762222d529ddb923311537356c3212c393159b6cfe57bf81930864e2cfaf30060c74
Malware Config
Extracted
azorult
http://165.22.238.171/index.php
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exepid process 724 1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe 724 1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exedescription pid process target process PID 724 wrote to memory of 732 724 1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe 1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe PID 724 wrote to memory of 732 724 1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe 1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe PID 724 wrote to memory of 732 724 1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe 1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exepid process 724 1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exedescription pid process target process PID 724 set thread context of 732 724 1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe 1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe -
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe"C:\Users\Admin\AppData\Local\Temp\1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe"C:\Users\Admin\AppData\Local\Temp\1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe"2⤵