Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
20/05/2022, 07:47
General
- Target 1fa0ac0a019a301a4e8e20ad7e27b89d86540318d84ed530f1ee8a695b9fe293.exe
- Size 573KB
- Sample220520-jmnswaghc2
- SHA256 1fa0ac0a019a301a4e8e20ad7e27b89d86540318d84ed530f1ee8a695b9fe293
Malware Config
Extracted
-
azorult
-
http://62.197.136.186/kendrick/index.php
Signatures
- Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
- suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M15
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M15
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fa0ac0a019a301a4e8e20ad7e27b89d86540318d84ed530f1ee8a695b9fe293.exe"C:\Users\Admin\AppData\Local\Temp\1fa0ac0a019a301a4e8e20ad7e27b89d86540318d84ed530f1ee8a695b9fe293.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1fa0ac0a019a301a4e8e20ad7e27b89d86540318d84ed530f1ee8a695b9fe293.exe"C:\Users\Admin\AppData\Local\Temp\1fa0ac0a019a301a4e8e20ad7e27b89d86540318d84ed530f1ee8a695b9fe293.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1956-130-0x0000000000F30000-0x0000000000FC6000-memory.dmp
memory/1956-131-0x0000000005DF0000-0x0000000006394000-memory.dmp
memory/1956-132-0x0000000005840000-0x00000000058D2000-memory.dmp
memory/1956-133-0x00000000059E0000-0x00000000059EA000-memory.dmp
memory/1956-134-0x0000000009340000-0x00000000093DC000-memory.dmp
memory/1956-135-0x00000000095C0000-0x0000000009626000-memory.dmp
memory/3124-137-0x0000000000400000-0x0000000000420000-memory.dmp
memory/3124-139-0x0000000000400000-0x0000000000420000-memory.dmp
memory/3124-140-0x0000000000400000-0x0000000000420000-memory.dmp