Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    20/05/2022, 13:37

General

  • Target

    NSL SUGARS LTD UNIT.exe

  • Size

    1.2MB

  • MD5

    dd02d84951a6b48b98f08abd3f79a278

  • SHA1

    d9b39d7fda6d314b4c49b5d5dc9e634ee14448df

  • SHA256

    7cd0f0947f0485f250747fe2e8eee845d912830239a949ac721335824ee03365

  • SHA512

    af0d3bd698a0b06e9a28382126e3599815ab501d1f61ff2492c8777ff00b98633f1264ecda266244a9b8ffccf20cf32ebab1eba11116ca2461d31c0a8aa4c71c

Malware Config

Extracted

Family

azorult

C2

http://49.12.98.113/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • suricata: ET MALWARE AZORult Variant.4 Checkin M2

    suricata: ET MALWARE AZORult Variant.4 Checkin M2

  • suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M13

    suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M13

  • Suspicious use of SetThreadContext 13 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NSL SUGARS LTD UNIT.exe
    "C:\Users\Admin\AppData\Local\Temp\NSL SUGARS LTD UNIT.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2796
    • C:\Users\Admin\AppData\Local\Temp\NSL SUGARS LTD UNIT.exe
      "C:\Users\Admin\AppData\Local\Temp\NSL SUGARS LTD UNIT.exe"
      2⤵
        PID:4124
      • C:\Users\Admin\AppData\Local\Temp\NSL SUGARS LTD UNIT.exe
        "C:\Users\Admin\AppData\Local\Temp\NSL SUGARS LTD UNIT.exe"
        2⤵
          PID:4304
        • C:\Users\Admin\AppData\Local\Temp\NSL SUGARS LTD UNIT.exe
          "C:\Users\Admin\AppData\Local\Temp\NSL SUGARS LTD UNIT.exe"
          2⤵
            PID:3628
          • C:\Users\Admin\AppData\Local\Temp\NSL SUGARS LTD UNIT.exe
            "C:\Users\Admin\AppData\Local\Temp\NSL SUGARS LTD UNIT.exe"
            2⤵
              PID:2464
            • C:\Users\Admin\AppData\Local\Temp\NSL SUGARS LTD UNIT.exe
              "C:\Users\Admin\AppData\Local\Temp\NSL SUGARS LTD UNIT.exe"
              2⤵
                PID:1184
              • C:\Users\Admin\AppData\Local\Temp\NSL SUGARS LTD UNIT.exe
                "C:\Users\Admin\AppData\Local\Temp\NSL SUGARS LTD UNIT.exe"
                2⤵
                  PID:2516
                • C:\Users\Admin\AppData\Local\Temp\NSL SUGARS LTD UNIT.exe
                  "C:\Users\Admin\AppData\Local\Temp\NSL SUGARS LTD UNIT.exe"
                  2⤵
                    PID:4060
                  • C:\Users\Admin\AppData\Local\Temp\NSL SUGARS LTD UNIT.exe
                    "C:\Users\Admin\AppData\Local\Temp\NSL SUGARS LTD UNIT.exe"
                    2⤵
                      PID:1372
                    • C:\Users\Admin\AppData\Local\Temp\NSL SUGARS LTD UNIT.exe
                      "C:\Users\Admin\AppData\Local\Temp\NSL SUGARS LTD UNIT.exe"
                      2⤵
                        PID:4012
                      • C:\Users\Admin\AppData\Local\Temp\NSL SUGARS LTD UNIT.exe
                        "C:\Users\Admin\AppData\Local\Temp\NSL SUGARS LTD UNIT.exe"
                        2⤵
                          PID:3368
                        • C:\Users\Admin\AppData\Local\Temp\NSL SUGARS LTD UNIT.exe
                          "C:\Users\Admin\AppData\Local\Temp\NSL SUGARS LTD UNIT.exe"
                          2⤵
                            PID:3740
                          • C:\Users\Admin\AppData\Local\Temp\NSL SUGARS LTD UNIT.exe
                            "C:\Users\Admin\AppData\Local\Temp\NSL SUGARS LTD UNIT.exe"
                            2⤵
                              PID:2264
                            • C:\Users\Admin\AppData\Local\Temp\NSL SUGARS LTD UNIT.exe
                              "C:\Users\Admin\AppData\Local\Temp\NSL SUGARS LTD UNIT.exe"
                              2⤵
                                PID:3840

                            Network

                                  MITRE ATT&CK Matrix

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • memory/2796-192-0x00000000015C0000-0x00000000015E0000-memory.dmp

                                    Filesize

                                    128KB

                                  • memory/2796-131-0x0000000004070000-0x00000000040A9000-memory.dmp

                                    Filesize

                                    228KB

                                  • memory/2796-130-0x0000000004030000-0x0000000004069000-memory.dmp

                                    Filesize

                                    228KB

                                  • memory/4124-141-0x0000000000400000-0x0000000000420000-memory.dmp

                                    Filesize

                                    128KB

                                  • memory/4124-133-0x0000000000400000-0x0000000000420000-memory.dmp

                                    Filesize

                                    128KB

                                  • memory/4304-151-0x00000000004B0000-0x00000000004D0000-memory.dmp

                                    Filesize

                                    128KB

                                  • memory/4304-143-0x00000000004B0000-0x00000000004D0000-memory.dmp

                                    Filesize

                                    128KB