Analysis
-
max time kernel
51s -
max time network
53s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
13-04-2021 09:04
Static task
static1
Behavioral task
behavioral1
Sample
invoice.scr
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
invoice.scr
-
Size
356KB
-
MD5
0f62ad64933edb9e9a62124f8f965d8c
-
SHA1
56f858b120126d45e384da71cc198a4f8f87870f
-
SHA256
c6971c3516ab280c7c6985ccc94062547116fcd3a7593fc84704030169c16e59
-
SHA512
61e28fd209bbe5ee006e5afc751fe441a89d98ca2471139ff5c6f825af402b408d90d8fab8acf51116d09e6d4329220f6a24238f8bdd282711181cf6231c677e
Score
10/10
Malware Config
Extracted
Family
azorult
C2
https://sterline.lt/lokk/32/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
invoice.scrdescription pid process target process PID 360 set thread context of 320 360 invoice.scr invoice.scr -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
invoice.scrpid process 360 invoice.scr 360 invoice.scr -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
invoice.scrdescription pid process Token: SeDebugPrivilege 360 invoice.scr -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
invoice.scrdescription pid process target process PID 360 wrote to memory of 320 360 invoice.scr invoice.scr PID 360 wrote to memory of 320 360 invoice.scr invoice.scr PID 360 wrote to memory of 320 360 invoice.scr invoice.scr PID 360 wrote to memory of 320 360 invoice.scr invoice.scr PID 360 wrote to memory of 320 360 invoice.scr invoice.scr PID 360 wrote to memory of 320 360 invoice.scr invoice.scr PID 360 wrote to memory of 320 360 invoice.scr invoice.scr PID 360 wrote to memory of 320 360 invoice.scr invoice.scr PID 360 wrote to memory of 320 360 invoice.scr invoice.scr PID 360 wrote to memory of 320 360 invoice.scr invoice.scr
Processes
-
C:\Users\Admin\AppData\Local\Temp\invoice.scr"C:\Users\Admin\AppData\Local\Temp\invoice.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\invoice.scrC:\Users\Admin\AppData\Local\Temp\invoice.scr2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/320-65-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/320-66-0x000000000041A1F8-mapping.dmp
-
memory/320-67-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/320-68-0x0000000075451000-0x0000000075453000-memory.dmpFilesize
8KB
-
memory/360-60-0x00000000011D0000-0x00000000011D1000-memory.dmpFilesize
4KB
-
memory/360-62-0x0000000000330000-0x0000000000332000-memory.dmpFilesize
8KB
-
memory/360-63-0x0000000001030000-0x0000000001083000-memory.dmpFilesize
332KB
-
memory/360-64-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB