Analysis

  • max time kernel
    68s
  • max time network
    71s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    28-09-2021 00:01

General

  • Target

    2f530a45e4acf58d16dad1b1e23b5b1419ba893c2f76f6625da3acb86933462f.exe

  • Size

    203KB

  • MD5

    73bd76f0549cc1992d943ddfd92a9c4d

  • SHA1

    802e70b76c7c0860b3a4a257b1bc96fc3430ff01

  • SHA256

    2f530a45e4acf58d16dad1b1e23b5b1419ba893c2f76f6625da3acb86933462f

  • SHA512

    4a524d1a552eb6d101f9ceb25c7dc608669eeca7dc99bc5ddc2b9d7d3c8f4ffd3cd8f12c3328b07d80888d6758aff970b3e6898f88c3451a058224b83007e521

Malware Config

Extracted

Family

azorult

C2

http://admin.svapofit.com/azs/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2f530a45e4acf58d16dad1b1e23b5b1419ba893c2f76f6625da3acb86933462f.exe
    "C:\Users\Admin\AppData\Local\Temp\2f530a45e4acf58d16dad1b1e23b5b1419ba893c2f76f6625da3acb86933462f.exe"
    1⤵
      PID:628

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/628-115-0x0000000000520000-0x0000000000521000-memory.dmp
      Filesize

      4KB

    • memory/628-114-0x00000000001E0000-0x00000000001F9000-memory.dmp
      Filesize

      100KB

    • memory/628-116-0x0000000000400000-0x000000000044A000-memory.dmp
      Filesize

      296KB