Analysis
-
max time kernel
63s -
max time network
126s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 19:40
General
-
Target
SecuriteInfo.com.Trojan.GenericKD.43115958.1782.291.exe
-
Size
310KB
-
MD5
5fb8a32f0cd1cac0d10d93282266be42
-
SHA1
2bba4375a7b73aa597292309fcb24d8eb2047cf9
-
SHA256
d8e21eb6b03cadb9d4eb6ed019293e2e068f9f44dd88c578edf6fe961cb7eaf4
-
SHA512
f3b5d830331bdbdaa92f9165c37901dd8edfce5ad423e854bc2fdf3ce8893e61f69e14d006c8e0022a481d4e0cb14c51f7aecf181a099aaa4967f0dd058f80fe
Score
10/10
Malware Config
Extracted
Family
azorult
C2
http://195.245.112.115/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.43115958.1782.291.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.43115958.1782.291.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.43115958.1782.291.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4032-4-0x000000000041A684-mapping.dmp
-
memory/4032-5-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4032-3-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB