Analysis
-
max time kernel
70s -
max time network
133s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
03-11-2020 18:04
Static task
static1
Behavioral task
behavioral1
Sample
e9608855df921a6bd122e4060cab126a0bd206b67e9c12618f3d74f5d3328bed.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
e9608855df921a6bd122e4060cab126a0bd206b67e9c12618f3d74f5d3328bed.exe
Resource
win10v20201028
General
-
Target
e9608855df921a6bd122e4060cab126a0bd206b67e9c12618f3d74f5d3328bed.exe
-
Size
68KB
-
MD5
790238f14a53368abaf6a1013e75b652
-
SHA1
5a27e72a2844ae0b3355644c9f167233d4aa6480
-
SHA256
e9608855df921a6bd122e4060cab126a0bd206b67e9c12618f3d74f5d3328bed
-
SHA512
ce55b017063b404f8a28593cbc3fc9e0f536b42318c38f602ae2972c9b1c399ff6739a4e0d1342f91a2942a44a86eb1996df1321d48f7e5486ceb45da01f7b70
Malware Config
Extracted
azorult
http://skilldrivinget.com/ojman/PL341/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
e9608855df921a6bd122e4060cab126a0bd206b67e9c12618f3d74f5d3328bed.exee9608855df921a6bd122e4060cab126a0bd206b67e9c12618f3d74f5d3328bed.exepid process 4696 e9608855df921a6bd122e4060cab126a0bd206b67e9c12618f3d74f5d3328bed.exe 3152 e9608855df921a6bd122e4060cab126a0bd206b67e9c12618f3d74f5d3328bed.exe 3152 e9608855df921a6bd122e4060cab126a0bd206b67e9c12618f3d74f5d3328bed.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e9608855df921a6bd122e4060cab126a0bd206b67e9c12618f3d74f5d3328bed.exedescription pid process target process PID 4696 set thread context of 3152 4696 e9608855df921a6bd122e4060cab126a0bd206b67e9c12618f3d74f5d3328bed.exe e9608855df921a6bd122e4060cab126a0bd206b67e9c12618f3d74f5d3328bed.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
e9608855df921a6bd122e4060cab126a0bd206b67e9c12618f3d74f5d3328bed.exepid process 4696 e9608855df921a6bd122e4060cab126a0bd206b67e9c12618f3d74f5d3328bed.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
e9608855df921a6bd122e4060cab126a0bd206b67e9c12618f3d74f5d3328bed.exepid process 4696 e9608855df921a6bd122e4060cab126a0bd206b67e9c12618f3d74f5d3328bed.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
e9608855df921a6bd122e4060cab126a0bd206b67e9c12618f3d74f5d3328bed.exedescription pid process target process PID 4696 wrote to memory of 3152 4696 e9608855df921a6bd122e4060cab126a0bd206b67e9c12618f3d74f5d3328bed.exe e9608855df921a6bd122e4060cab126a0bd206b67e9c12618f3d74f5d3328bed.exe PID 4696 wrote to memory of 3152 4696 e9608855df921a6bd122e4060cab126a0bd206b67e9c12618f3d74f5d3328bed.exe e9608855df921a6bd122e4060cab126a0bd206b67e9c12618f3d74f5d3328bed.exe PID 4696 wrote to memory of 3152 4696 e9608855df921a6bd122e4060cab126a0bd206b67e9c12618f3d74f5d3328bed.exe e9608855df921a6bd122e4060cab126a0bd206b67e9c12618f3d74f5d3328bed.exe PID 4696 wrote to memory of 3152 4696 e9608855df921a6bd122e4060cab126a0bd206b67e9c12618f3d74f5d3328bed.exe e9608855df921a6bd122e4060cab126a0bd206b67e9c12618f3d74f5d3328bed.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9608855df921a6bd122e4060cab126a0bd206b67e9c12618f3d74f5d3328bed.exe"C:\Users\Admin\AppData\Local\Temp\e9608855df921a6bd122e4060cab126a0bd206b67e9c12618f3d74f5d3328bed.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\e9608855df921a6bd122e4060cab126a0bd206b67e9c12618f3d74f5d3328bed.exe"C:\Users\Admin\AppData\Local\Temp\e9608855df921a6bd122e4060cab126a0bd206b67e9c12618f3d74f5d3328bed.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3152