Analysis

  • max time kernel
    13s
  • max time network
    111s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    23-04-2021 13:02

General

  • Target

    A9C9824497908A525A168C43D743FEA3D1F5DC4C3004E.exe

  • Size

    1.2MB

  • MD5

    db11017a353658fcc955f9135686b16e

  • SHA1

    a1d450a61681d4f2e882f84b5d505b5d47839e5d

  • SHA256

    a9c9824497908a525a168c43d743fea3d1f5dc4c3004e8fe51b77a28ac018829

  • SHA512

    3b2d5153e4baf25488374ff028bd6cad8fcc9ac1057252b3ef47a1938a7798c7d60efab8fc5083f26c79def5a1455e8c88d1cdfdda0e15fd668fcb991b7e2d59

Malware Config

Extracted

Family

azorult

C2

http://cryptofaze.com/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NTFS ADS 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\A9C9824497908A525A168C43D743FEA3D1F5DC4C3004E.exe
    "C:\Users\Admin\AppData\Local\Temp\A9C9824497908A525A168C43D743FEA3D1F5DC4C3004E.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • NTFS ADS
    • Suspicious use of WriteProcessMemory
    PID:4804
    • C:\Windows\SysWOW64\dllhost.exe
      "C:\Windows\System32\dllhost.exe"
      2⤵
        PID:3296
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /k ping 127.0.0.1 -t 0 & del C:\Users\Admin\AppData\Local\Temp\A9C9824497908A525A168C43D743FEA3D1F5DC4C3004E.exe & exit
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4160
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -t 0
          3⤵
          • Runs ping.exe
          PID:3212

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    System Information Discovery

    1
    T1082

    Remote System Discovery

    1
    T1018

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3212-123-0x0000000000000000-mapping.dmp
    • memory/3296-114-0x0000000000400000-0x0000000000420000-memory.dmp
      Filesize

      128KB

    • memory/3296-118-0x000000000041A684-mapping.dmp
    • memory/4160-122-0x0000000000000000-mapping.dmp
    • memory/4804-121-0x0000000003A00000-0x0000000003A01000-memory.dmp
      Filesize

      4KB