Analysis
-
max time kernel
39s -
max time network
62s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20/05/2022, 14:31
Static task
static1
Behavioral task
behavioral1
Sample
Company Profile.exe
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Company Profile.exe
Resource
win10v2004-20220414-en
0 signatures
0 seconds
General
-
Target
Company Profile.exe
-
Size
958KB
-
MD5
8da09001b645c9853df37e3085d5dd94
-
SHA1
5646c895bff39e0f9806382f4eca8533a3522e88
-
SHA256
f484f2e953d9571e035e86dd89c82755ce0684fddd30b3d41bac21ac65f0cff4
-
SHA512
bc3dc8cd378ee305a71f1f294419a0676b404875211c2dba390caba65b14e915406eb09c6801f18b8e731aa6f1141b0bd5c8d8a3ebbf66f8b5d0a0b9f16e957b
Score
10/10
Malware Config
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
suricata: ET MALWARE AZORult Variant.4 Checkin M2
suricata: ET MALWARE AZORult Variant.4 Checkin M2
-
suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M6
suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M6
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1904 set thread context of 904 1904 Company Profile.exe 27 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1904 Company Profile.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1904 Company Profile.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1904 wrote to memory of 904 1904 Company Profile.exe 27 PID 1904 wrote to memory of 904 1904 Company Profile.exe 27 PID 1904 wrote to memory of 904 1904 Company Profile.exe 27 PID 1904 wrote to memory of 904 1904 Company Profile.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\Company Profile.exe"C:\Users\Admin\AppData\Local\Temp\Company Profile.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\Company Profile.exe"C:\Users\Admin\AppData\Local\Temp\Company Profile.exe"2⤵PID:904
-