Analysis
- max time kernel
123s - max time network
126s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
04/01/2022, 14:02
General
- Target Technical Specifications.exe
- Size 1.2MB
- Sample220104-rb5k9aahfm
- SHA256 f1ca559f0b8eb59d045fbd5d44fbf90d4c179c798691064c3f3fa92b0998be56
Malware Config
Extracted
-
azorult
-
http://2.58.149.59//index.php
Signatures
- Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Technical Specifications.exe"C:\Users\Admin\AppData\Local\Temp\Technical Specifications.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Technical Specifications.exe"C:\Users\Admin\AppData\Local\Temp\Technical Specifications.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/752-124-0x0000000000400000-0x0000000000420000-memory.dmp
memory/752-126-0x0000000000400000-0x0000000000420000-memory.dmp
memory/3668-115-0x0000000000830000-0x0000000000966000-memory.dmp
memory/3668-116-0x0000000000830000-0x0000000000966000-memory.dmp
memory/3668-117-0x00000000055C0000-0x0000000005ABE000-memory.dmp
memory/3668-118-0x00000000051B0000-0x0000000005242000-memory.dmp
memory/3668-119-0x00000000050C0000-0x00000000055BE000-memory.dmp
memory/3668-120-0x0000000005310000-0x000000000531A000-memory.dmp
memory/3668-121-0x00000000055A0000-0x00000000055B0000-memory.dmp
memory/3668-122-0x00000000075B0000-0x000000000764C000-memory.dmp
memory/3668-123-0x0000000007560000-0x00000000075AE000-memory.dmp