Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    27-09-2021 23:03

General

  • Target

    2F530A45E4ACF58D16DAD1B1E23B5B1419BA893C2F76F.exe

  • Size

    203KB

  • MD5

    73bd76f0549cc1992d943ddfd92a9c4d

  • SHA1

    802e70b76c7c0860b3a4a257b1bc96fc3430ff01

  • SHA256

    2f530a45e4acf58d16dad1b1e23b5b1419ba893c2f76f6625da3acb86933462f

  • SHA512

    4a524d1a552eb6d101f9ceb25c7dc608669eeca7dc99bc5ddc2b9d7d3c8f4ffd3cd8f12c3328b07d80888d6758aff970b3e6898f88c3451a058224b83007e521

Malware Config

Extracted

Family

azorult

C2

http://admin.svapofit.com/azs/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2F530A45E4ACF58D16DAD1B1E23B5B1419BA893C2F76F.exe
    "C:\Users\Admin\AppData\Local\Temp\2F530A45E4ACF58D16DAD1B1E23B5B1419BA893C2F76F.exe"
    1⤵
      PID:1820

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1820-60-0x0000000076641000-0x0000000076643000-memory.dmp
      Filesize

      8KB

    • memory/1820-61-0x0000000000230000-0x0000000000249000-memory.dmp
      Filesize

      100KB

    • memory/1820-62-0x00000000002F0000-0x00000000002F1000-memory.dmp
      Filesize

      4KB

    • memory/1820-63-0x0000000000400000-0x000000000044A000-memory.dmp
      Filesize

      296KB