Overview

overview

10

Static

static

SecuriteIn...28.exe

windows7_x64

10

SecuriteIn...28.exe

windows10_x64

10

Analysis

  • max time kernel
    130s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    30-04-2021 21:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Trojan.Inject4.11083.19609.1028.exe

  • Size

    587KB

  • MD5

    eb6c0ff23c01dd3528789c8142890547

  • SHA1

    7cfed1e8bed52f4f376e5702dc303b6235b8a19d

  • SHA256

    fe69416ea50c8316791d7de7da893f9189c3d5f34cb9c64026206d19325ef5c5

  • SHA512

    0e3bf1fbbe15a26d6648a1eca4f2d66544a9d4293956aaaac8d258141d74ce11d4849b610285342219d315836dbe9e71aec9a1896020bb5def645ccdf994d94b

Score
10/10
azorultinfostealertrojan

Malware Config

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.11083.19609.1028.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.11083.19609.1028.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1072
    • C:\Users\Admin\AppData\Local\Temp\ozflkjgfkldsad.exe
      "C:\Users\Admin\AppData\Local\Temp\ozflkjgfkldsad.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:392
      • C:\Users\Admin\AppData\Local\Temp\ozflkjgfkldsad.exe
        "{path}"
        3⤵
        • Executes dropped EXE
        PID:1696
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.11083.19609.1028.exe
      "{path}"
      2⤵
        PID:1108
      • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.11083.19609.1028.exe
        "{path}"
        2⤵
          PID:808
        • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.11083.19609.1028.exe
          "{path}"
          2⤵
            PID:544

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\ozflkjgfkldsad.exe
          MD5

          b573e394640d7c1d5493e0f57c905390

          SHA1

          040e9bb1ff744a02128e781b3763eb1908823e20

          SHA256

          e35475374a222d26bfb9f79785226629a92b18e1d0eea149daf2332e1c98ac12

          SHA512

          282d5147175bed23e8147e9ab0aa7d21f9bc6462b348850fbf42f16e5ce0c6463cfd0e19b1943901529d49dff2c02226237dbf3abd4218d82d9bbacb836bd63c

          Download Submit
        • C:\Users\Admin\AppData\Local\Temp\ozflkjgfkldsad.exe
          MD5

          b573e394640d7c1d5493e0f57c905390

          SHA1

          040e9bb1ff744a02128e781b3763eb1908823e20

          SHA256

          e35475374a222d26bfb9f79785226629a92b18e1d0eea149daf2332e1c98ac12

          SHA512

          282d5147175bed23e8147e9ab0aa7d21f9bc6462b348850fbf42f16e5ce0c6463cfd0e19b1943901529d49dff2c02226237dbf3abd4218d82d9bbacb836bd63c

          Download Submit
        • C:\Users\Admin\AppData\Local\Temp\ozflkjgfkldsad.exe
          MD5

          b573e394640d7c1d5493e0f57c905390

          SHA1

          040e9bb1ff744a02128e781b3763eb1908823e20

          SHA256

          e35475374a222d26bfb9f79785226629a92b18e1d0eea149daf2332e1c98ac12

          SHA512

          282d5147175bed23e8147e9ab0aa7d21f9bc6462b348850fbf42f16e5ce0c6463cfd0e19b1943901529d49dff2c02226237dbf3abd4218d82d9bbacb836bd63c

          Download Submit
        • \Users\Admin\AppData\Local\Temp\ozflkjgfkldsad.exe
          MD5

          b573e394640d7c1d5493e0f57c905390

          SHA1

          040e9bb1ff744a02128e781b3763eb1908823e20

          SHA256

          e35475374a222d26bfb9f79785226629a92b18e1d0eea149daf2332e1c98ac12

          SHA512

          282d5147175bed23e8147e9ab0aa7d21f9bc6462b348850fbf42f16e5ce0c6463cfd0e19b1943901529d49dff2c02226237dbf3abd4218d82d9bbacb836bd63c

          Download Submit
        • \Users\Admin\AppData\Local\Temp\ozflkjgfkldsad.exe
          MD5

          b573e394640d7c1d5493e0f57c905390

          SHA1

          040e9bb1ff744a02128e781b3763eb1908823e20

          SHA256

          e35475374a222d26bfb9f79785226629a92b18e1d0eea149daf2332e1c98ac12

          SHA512

          282d5147175bed23e8147e9ab0aa7d21f9bc6462b348850fbf42f16e5ce0c6463cfd0e19b1943901529d49dff2c02226237dbf3abd4218d82d9bbacb836bd63c

          Download Submit
        • memory/392-78-0x00000000059E0000-0x0000000005A59000-memory.dmp
          Filesize

          484KB

          Download
        • memory/392-75-0x0000000004D40000-0x0000000004D41000-memory.dmp
          Filesize

          4KB

          Download
        • memory/392-79-0x0000000000450000-0x0000000000480000-memory.dmp
          Filesize

          192KB

          Download
        • memory/392-67-0x0000000000000000-mapping.dmp
          Download
        • memory/392-70-0x0000000000940000-0x0000000000941000-memory.dmp
          Filesize

          4KB

          Download
        • memory/544-76-0x0000000000400000-0x0000000000420000-memory.dmp
          Filesize

          128KB

          Download
        • memory/544-73-0x000000000041A684-mapping.dmp
          Download
        • memory/544-74-0x0000000075411000-0x0000000075413000-memory.dmp
          Filesize

          8KB

          Download
        • memory/544-72-0x0000000000400000-0x0000000000420000-memory.dmp
          Filesize

          128KB

          Download
        • memory/1072-64-0x0000000002390000-0x00000000023FE000-memory.dmp
          Filesize

          440KB

          Download
        • memory/1072-60-0x0000000000280000-0x0000000000281000-memory.dmp
          Filesize

          4KB

          Download
        • memory/1072-65-0x0000000000340000-0x000000000035E000-memory.dmp
          Filesize

          120KB

          Download
        • memory/1072-63-0x0000000000330000-0x000000000033E000-memory.dmp
          Filesize

          56KB

          Download
        • memory/1072-62-0x0000000004920000-0x0000000004921000-memory.dmp
          Filesize

          4KB

          Download
        • memory/1696-81-0x0000000000400000-0x0000000000434000-memory.dmp
          Filesize

          208KB

          Download
        • memory/1696-82-0x0000000000417A8B-mapping.dmp
          Download
        • memory/1696-85-0x0000000000400000-0x0000000000434000-memory.dmp
          Filesize

          208KB

          Download