27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe

General
Target

27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe

Filesize

779KB

Completed

21-04-2021 18:06

Score
10 /10
MD5

7c853c98eb2e158d2453a4318a4d4ebc

SHA1

c80b146c2e1adfc4cef469f8af5bb182c124c6fa

SHA256

27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609

Malware Config

Extracted

Family azorult
C2

http://45.144.225.131/index.php

Signatures 3

Filter: none

  • Azorult

    Description

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Suspicious use of SetThreadContext
    27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 780 set thread context of 40878027100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe
  • Suspicious use of WriteProcessMemory
    27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 780 wrote to memory of 40878027100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe
    PID 780 wrote to memory of 40878027100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe
    PID 780 wrote to memory of 40878027100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe
    PID 780 wrote to memory of 40878027100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe
    PID 780 wrote to memory of 40878027100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe
    PID 780 wrote to memory of 40878027100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe
    PID 780 wrote to memory of 40878027100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe
    PID 780 wrote to memory of 40878027100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe
    PID 780 wrote to memory of 40878027100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe
Processes 2
  • C:\Users\Admin\AppData\Local\Temp\27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe
    "C:\Users\Admin\AppData\Local\Temp\27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe"
    Suspicious use of SetThreadContext
    Suspicious use of WriteProcessMemory
    PID:780
    • C:\Users\Admin\AppData\Local\Temp\27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe
      "{path}"
      PID:408
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/408-115-0x0000000000400000-0x0000000000420000-memory.dmp

                          • memory/408-116-0x000000000041A1F8-mapping.dmp

                          • memory/408-117-0x0000000000400000-0x0000000000420000-memory.dmp

                          • memory/780-114-0x0000000002A70000-0x0000000002A71000-memory.dmp