Analysis

  • max time kernel
    39s
  • max time network
    43s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    20/05/2022, 14:21

General

  • Target

    company profile.exe

  • Size

    628KB

  • MD5

    5a8f760f3528fc3c94baec387cd05f7a

  • SHA1

    d65b195f4b83dd025e1605cbc51fcb2f07b27f74

  • SHA256

    980ba1a8bbabaea3660d93c50b0467c22e1934ca026eeed63339c2d36f888294

  • SHA512

    871fa63b645feaacb075a5c065b380c58d815a85a4e259e168eb19a46bc2cfd37726283472196dd7d6b5073d127f3427d9084cf1328758d1760af6f91d8d0b98

Malware Config

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\company profile.exe
    "C:\Users\Admin\AppData\Local\Temp\company profile.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Users\Admin\AppData\Local\Temp\company profile.exe
      "C:\Users\Admin\AppData\Local\Temp\company profile.exe"
      2⤵
        PID:1672

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2040-54-0x0000000075191000-0x0000000075193000-memory.dmp

            Filesize

            8KB

          • memory/2040-56-0x0000000000400000-0x00000000004A3000-memory.dmp

            Filesize

            652KB