Overview

overview

10

Static

static

1

08bb58c8a1...9a.exe

windows7_x64

7

08bb58c8a1...9a.exe

windows10_x64

10

Analysis

  • max time kernel
    12s
  • max time network
    116s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    24-06-2021 12:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    08bb58c8a18dae95ca3131728861a226549301b13e23d7adff0ac5d94e75129a.exe

  • Size

    338KB

  • MD5

    24676c7286358c4db1b693c07032b737

  • SHA1

    bb0377a8fdd9b8a7b16d4932f76d5c6dd2cb193d

  • SHA256

    08bb58c8a18dae95ca3131728861a226549301b13e23d7adff0ac5d94e75129a

  • SHA512

    0e625ad092ccc6b10ad49061ae69f0ea92eeb70511f8dea22f6058d91fc0ac0c3d5f3dac1a91f13d6e1275b955fdf16ba7a9a42013208dd1b7e8199c8e3f7a8c

Score
10/10
azorultinfostealertrojan

Malware Config

Extracted

Family

azorult

C2

http://smkn1cilegon.sch.id/huPI/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\08bb58c8a18dae95ca3131728861a226549301b13e23d7adff0ac5d94e75129a.exe
    "C:\Users\Admin\AppData\Local\Temp\08bb58c8a18dae95ca3131728861a226549301b13e23d7adff0ac5d94e75129a.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1692
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Users\Admin\AppData\Local\Temp\08bb58c8a18dae95ca3131728861a226549301b13e23d7adff0ac5d94e75129a.exe"
      2⤵
        PID:2780

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Temp\nsw2468.tmp\System.dll
      MD5

      56a321bd011112ec5d8a32b2f6fd3231

      SHA1

      df20e3a35a1636de64df5290ae5e4e7572447f78

      SHA256

      bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

      SHA512

      5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

      Download Submit
    • \Users\Admin\AppData\Local\Temp\nsw2468.tmp\System.dll
      MD5

      56a321bd011112ec5d8a32b2f6fd3231

      SHA1

      df20e3a35a1636de64df5290ae5e4e7572447f78

      SHA256

      bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

      SHA512

      5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

      Download Submit
    • memory/2780-116-0x000000000041A684-mapping.dmp
      Download
    • memory/2780-117-0x0000000000400000-0x0000000000420000-memory.dmp
      Filesize

      128KB

      Download