Overview

overview

10

Static

static

6bf4ce3816...3d.exe

windows7_x64

10

6bf4ce3816...3d.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    08-05-2021 20:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6bf4ce3816de412d0cdfc51e6a227a87e0427cba267f76fe846f200eb407883d.exe

  • Size

    1.4MB

  • MD5

    06fb398386bae0bbfbfa2d67ad13b016

  • SHA1

    45ad3b114e1ec168eee2a65f98bb302767bccc2f

  • SHA256

    6bf4ce3816de412d0cdfc51e6a227a87e0427cba267f76fe846f200eb407883d

  • SHA512

    6253e13f16b6f99cbac29d03f01cfabc8978d51bb08ba0cdabea948b6761f9cff5c7543e8a0a0db626b1ccd682d637ccfdf116b6e63f66660842fdbdabefd0f5

Score
10/10
azorultinfostealertrojan

Malware Config

Extracted

Family

azorult

C2

http://49.12.98.122/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • Suspicious use of SetThreadContext 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: MapViewOfSection 14 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6bf4ce3816de412d0cdfc51e6a227a87e0427cba267f76fe846f200eb407883d.exe
    "C:\Users\Admin\AppData\Local\Temp\6bf4ce3816de412d0cdfc51e6a227a87e0427cba267f76fe846f200eb407883d.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3872
    • C:\Users\Admin\AppData\Local\Temp\6bf4ce3816de412d0cdfc51e6a227a87e0427cba267f76fe846f200eb407883d.exe
      "C:\Users\Admin\AppData\Local\Temp\6bf4ce3816de412d0cdfc51e6a227a87e0427cba267f76fe846f200eb407883d.exe"
      2⤵
        PID:2772
      • C:\Users\Admin\AppData\Local\Temp\6bf4ce3816de412d0cdfc51e6a227a87e0427cba267f76fe846f200eb407883d.exe
        "C:\Users\Admin\AppData\Local\Temp\6bf4ce3816de412d0cdfc51e6a227a87e0427cba267f76fe846f200eb407883d.exe"
        2⤵
          PID:844
        • C:\Users\Admin\AppData\Local\Temp\6bf4ce3816de412d0cdfc51e6a227a87e0427cba267f76fe846f200eb407883d.exe
          "C:\Users\Admin\AppData\Local\Temp\6bf4ce3816de412d0cdfc51e6a227a87e0427cba267f76fe846f200eb407883d.exe"
          2⤵
            PID:492
          • C:\Users\Admin\AppData\Local\Temp\6bf4ce3816de412d0cdfc51e6a227a87e0427cba267f76fe846f200eb407883d.exe
            "C:\Users\Admin\AppData\Local\Temp\6bf4ce3816de412d0cdfc51e6a227a87e0427cba267f76fe846f200eb407883d.exe"
            2⤵
              PID:2188
            • C:\Users\Admin\AppData\Local\Temp\6bf4ce3816de412d0cdfc51e6a227a87e0427cba267f76fe846f200eb407883d.exe
              "C:\Users\Admin\AppData\Local\Temp\6bf4ce3816de412d0cdfc51e6a227a87e0427cba267f76fe846f200eb407883d.exe"
              2⤵
                PID:2408
              • C:\Users\Admin\AppData\Local\Temp\6bf4ce3816de412d0cdfc51e6a227a87e0427cba267f76fe846f200eb407883d.exe
                "C:\Users\Admin\AppData\Local\Temp\6bf4ce3816de412d0cdfc51e6a227a87e0427cba267f76fe846f200eb407883d.exe"
                2⤵
                  PID:3792
                • C:\Users\Admin\AppData\Local\Temp\6bf4ce3816de412d0cdfc51e6a227a87e0427cba267f76fe846f200eb407883d.exe
                  "C:\Users\Admin\AppData\Local\Temp\6bf4ce3816de412d0cdfc51e6a227a87e0427cba267f76fe846f200eb407883d.exe"
                  2⤵
                    PID:1840
                  • C:\Users\Admin\AppData\Local\Temp\6bf4ce3816de412d0cdfc51e6a227a87e0427cba267f76fe846f200eb407883d.exe
                    "C:\Users\Admin\AppData\Local\Temp\6bf4ce3816de412d0cdfc51e6a227a87e0427cba267f76fe846f200eb407883d.exe"
                    2⤵
                      PID:2168
                    • C:\Users\Admin\AppData\Local\Temp\6bf4ce3816de412d0cdfc51e6a227a87e0427cba267f76fe846f200eb407883d.exe
                      "C:\Users\Admin\AppData\Local\Temp\6bf4ce3816de412d0cdfc51e6a227a87e0427cba267f76fe846f200eb407883d.exe"
                      2⤵
                        PID:1068
                      • C:\Users\Admin\AppData\Local\Temp\6bf4ce3816de412d0cdfc51e6a227a87e0427cba267f76fe846f200eb407883d.exe
                        "C:\Users\Admin\AppData\Local\Temp\6bf4ce3816de412d0cdfc51e6a227a87e0427cba267f76fe846f200eb407883d.exe"
                        2⤵
                          PID:1032
                        • C:\Users\Admin\AppData\Local\Temp\6bf4ce3816de412d0cdfc51e6a227a87e0427cba267f76fe846f200eb407883d.exe
                          "C:\Users\Admin\AppData\Local\Temp\6bf4ce3816de412d0cdfc51e6a227a87e0427cba267f76fe846f200eb407883d.exe"
                          2⤵
                            PID:3172
                          • C:\Users\Admin\AppData\Local\Temp\6bf4ce3816de412d0cdfc51e6a227a87e0427cba267f76fe846f200eb407883d.exe
                            "C:\Users\Admin\AppData\Local\Temp\6bf4ce3816de412d0cdfc51e6a227a87e0427cba267f76fe846f200eb407883d.exe"
                            2⤵
                              PID:2628
                            • C:\Users\Admin\AppData\Local\Temp\6bf4ce3816de412d0cdfc51e6a227a87e0427cba267f76fe846f200eb407883d.exe
                              "C:\Users\Admin\AppData\Local\Temp\6bf4ce3816de412d0cdfc51e6a227a87e0427cba267f76fe846f200eb407883d.exe"
                              2⤵
                                PID:684
                              • C:\Users\Admin\AppData\Local\Temp\6bf4ce3816de412d0cdfc51e6a227a87e0427cba267f76fe846f200eb407883d.exe
                                "C:\Users\Admin\AppData\Local\Temp\6bf4ce3816de412d0cdfc51e6a227a87e0427cba267f76fe846f200eb407883d.exe"
                                2⤵
                                  PID:3084

                              Network

                              MITRE ATT&CK Matrix

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4
                                MD5

                                9bd290c73c295139470b5a56f8d857bb

                                SHA1

                                c838907b18895bc98a601e27c30b5de9acef88e7

                                SHA256

                                bfc8f14e57e8fe77f10ec2c420b746a75291c034dd872bc673e459ebfdac5968

                                SHA512

                                c8a77182ce1832fe96f35a2816120c9df00eca1aa29dce49a111f057d3583b3b25a69c88f579cc84f4ff43fbf17f663a1e07234aacdd1831bbdb443f8f234e36

                                Download Submit
                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D6BFA711ABA2991193D033415BA2672D
                                MD5

                                72e73c5aa7624e24cda093421bf29301

                                SHA1

                                81f1468cf728e9bf12967eca24ffe283add87063

                                SHA256

                                f138ded59e6fff90af611ee34d29db68ea42eca807c02ca128396574901aeba6

                                SHA512

                                0acb41e9ed2d79b32c3ed8d2401248ccae54936472a950beb0861c38d182a2ca9b032bc214e05b5953ad4417849360691cc317f20c29158399bea995a9e5f7ac

                                Download Submit
                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4
                                MD5

                                f0e53ff098018977f95993a290627088

                                SHA1

                                660e63fd6255d6ee921051685358e333b7474442

                                SHA256

                                e3dcbde9d5bb38ab234086a161491806cf394d6d5cf5c278cd1634f79f58597f

                                SHA512

                                c94fe948b65a678007a4060e1bb3e28997e1c8250e8f5ded206484a953058aef86db8107b9f6e7e4e91ea93b4952dd9ab39b4a0a81a787822798a5df38f47ab0

                                Download Submit
                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D6BFA711ABA2991193D033415BA2672D
                                MD5

                                63cfc71bea9784426211626b55b00133

                                SHA1

                                0b330e4df07979c53ccf4bb2a0d3e6e722ba99e0

                                SHA256

                                7bca9ae74bfbfae67649f4938c7f090fb58d9dd7a25ccd22e0e5576df28d00df

                                SHA512

                                a80d257c2bb70656862936819b8ec50ccf8443dbde0f92d3b8617b62ae670e1fdc333a507c96b1f636a177f9d649f48984ccb91c260dd8f11ba9599cf9bd344c

                                Download Submit
                              • memory/492-118-0x000000000041A1F8-mapping.dmp
                                Download
                              • memory/684-149-0x000000000041A1F8-mapping.dmp
                                Download
                              • memory/1032-140-0x000000000041A1F8-mapping.dmp
                                Download
                              • memory/1068-137-0x000000000041A1F8-mapping.dmp
                                Download
                              • memory/1840-131-0x000000000041A1F8-mapping.dmp
                                Download
                              • memory/2168-134-0x000000000041A1F8-mapping.dmp
                                Download
                              • memory/2408-125-0x000000000041A1F8-mapping.dmp
                                Download
                              • memory/2628-146-0x000000000041A1F8-mapping.dmp
                                Download
                              • memory/2772-115-0x000000000041A1F8-mapping.dmp
                                Download
                              • memory/2772-117-0x0000000000400000-0x0000000000420000-memory.dmp
                                Filesize

                                128KB

                                Download
                              • memory/3084-152-0x000000000041A1F8-mapping.dmp
                                Download
                              • memory/3172-143-0x000000000041A1F8-mapping.dmp
                                Download
                              • memory/3792-128-0x000000000041A1F8-mapping.dmp
                                Download
                              • memory/3872-114-0x0000000003CF0000-0x0000000003D29000-memory.dmp
                                Filesize

                                228KB

                                Download
                              • memory/3872-116-0x0000000003D30000-0x0000000003D69000-memory.dmp
                                Filesize

                                228KB

                                Download