Analysis
-
max time kernel
61s -
max time network
65s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
14-05-2022 13:50
Static task
static1
Behavioral task
behavioral1
Sample
6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe
Resource
win10v2004-20220414-en
General
-
Target
6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe
-
Size
863KB
-
MD5
e31a855d80f25a0e2773816c7ca9e248
-
SHA1
41dd5cc5dbd88d16f03eab4824b9ba06e1ad496f
-
SHA256
6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199
-
SHA512
98f558f8ef3e3198cb2b57c0a3693b29b155e17be93616659eb37e46729b6277c767a74f5a5529ecd0d128e7f695b7f5cca9a08fd061bfa169fb0867e30a33ed
Malware Config
Extracted
azorult
http://89.43.107.198/mpom/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Processes:
resource yara_rule behavioral1/memory/872-56-0x0000000000340000-0x0000000000358000-memory.dmp net_reactor -
Suspicious use of SetThreadContext 1 IoCs
Processes:
6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exedescription pid process target process PID 872 set thread context of 1524 872 6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe 6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exedescription pid process target process PID 872 wrote to memory of 1524 872 6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe 6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe PID 872 wrote to memory of 1524 872 6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe 6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe PID 872 wrote to memory of 1524 872 6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe 6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe PID 872 wrote to memory of 1524 872 6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe 6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe PID 872 wrote to memory of 1524 872 6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe 6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe PID 872 wrote to memory of 1524 872 6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe 6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe PID 872 wrote to memory of 1524 872 6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe 6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe PID 872 wrote to memory of 1524 872 6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe 6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe PID 872 wrote to memory of 1524 872 6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe 6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe PID 872 wrote to memory of 1524 872 6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe 6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe"C:\Users\Admin\AppData\Local\Temp\6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe"C:\Users\Admin\AppData\Local\Temp\6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe"2⤵PID:1524
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/872-54-0x00000000013A0000-0x000000000147E000-memory.dmpFilesize
888KB
-
memory/872-55-0x00000000768D1000-0x00000000768D3000-memory.dmpFilesize
8KB
-
memory/872-56-0x0000000000340000-0x0000000000358000-memory.dmpFilesize
96KB
-
memory/872-57-0x0000000005870000-0x0000000005912000-memory.dmpFilesize
648KB
-
memory/872-58-0x0000000000640000-0x0000000000662000-memory.dmpFilesize
136KB
-
memory/1524-59-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1524-60-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1524-62-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1524-63-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1524-64-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1524-66-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1524-67-0x000000000041A684-mapping.dmp
-
memory/1524-69-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1524-71-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB