Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
07-10-2021 06:06
Static task
static1
Behavioral task
behavioral1
Sample
60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe
Resource
win10-en-20210920
General
-
Target
60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe
-
Size
443KB
-
MD5
21c891db70bc3aa3ec9d015b0fc12692
-
SHA1
ae592b5a328129f2ec0531dd87c6f28f87b39567
-
SHA256
60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6
-
SHA512
1e95aff4ff14ca155aa2b7625e2b95f787a6098c08e2d48ac39c8ba398c92f40d4cfa343e4ed6c71716cfca827bd4eea5c3aa1db12f7f9a04175b796bf9dfaa8
Malware Config
Extracted
azorult
http://casabayshops.co/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exedescription pid process target process PID 1572 set thread context of 3804 1572 60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe 60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exedescription pid process target process PID 1572 wrote to memory of 3804 1572 60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe 60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe PID 1572 wrote to memory of 3804 1572 60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe 60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe PID 1572 wrote to memory of 3804 1572 60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe 60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe PID 1572 wrote to memory of 3804 1572 60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe 60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe PID 1572 wrote to memory of 3804 1572 60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe 60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe PID 1572 wrote to memory of 3804 1572 60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe 60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe PID 1572 wrote to memory of 3804 1572 60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe 60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe PID 1572 wrote to memory of 3804 1572 60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe 60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe PID 1572 wrote to memory of 3804 1572 60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe 60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe"C:\Users\Admin\AppData\Local\Temp\60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe"C:\Users\Admin\AppData\Local\Temp\60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1572-115-0x0000000000620000-0x000000000076A000-memory.dmpFilesize
1.3MB
-
memory/3804-117-0x000000000041A1F8-mapping.dmp
-
memory/3804-116-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3804-118-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB