Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20/05/2022, 18:48
Static task
static1
Behavioral task
behavioral1
Sample
f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe
Resource
win10v2004-20220414-en
General
-
Target
f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe
-
Size
598KB
-
MD5
4872dfbfd5180fb118d93b9a786d1eb0
-
SHA1
0d42a59ef21ec45a8317d828111ab49beea8b312
-
SHA256
f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901
-
SHA512
b8887871ec530484e77e16af1afd10599f8df9cdca63af0fd14f5b1e730d30d3e4790bd15fcd46f8b014bc4e5452be72819993bfa336d9e09ae2f283c69b4ae2
Malware Config
Extracted
azorult
http://185.43.220.15/~yafpn149/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
suricata: ET MALWARE AZORult Variant.4 Checkin M2
suricata: ET MALWARE AZORult Variant.4 Checkin M2
-
suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M4
suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M4
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1836 set thread context of 908 1836 f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe 28 -
Program crash 1 IoCs
pid pid_target Process procid_target 1636 908 WerFault.exe 28 -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1836 f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1836 f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1836 wrote to memory of 908 1836 f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe 28 PID 1836 wrote to memory of 908 1836 f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe 28 PID 1836 wrote to memory of 908 1836 f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe 28 PID 1836 wrote to memory of 908 1836 f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe 28 PID 1836 wrote to memory of 908 1836 f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe 28 PID 908 wrote to memory of 1636 908 f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe 31 PID 908 wrote to memory of 1636 908 f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe 31 PID 908 wrote to memory of 1636 908 f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe 31 PID 908 wrote to memory of 1636 908 f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe"C:\Users\Admin\AppData\Local\Temp\f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe"f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 7443⤵
- Program crash
PID:1636
-
-