Analysis

  • max time kernel
    42s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    20/05/2022, 18:48

General

  • Target

    f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe

  • Size

    598KB

  • MD5

    4872dfbfd5180fb118d93b9a786d1eb0

  • SHA1

    0d42a59ef21ec45a8317d828111ab49beea8b312

  • SHA256

    f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901

  • SHA512

    b8887871ec530484e77e16af1afd10599f8df9cdca63af0fd14f5b1e730d30d3e4790bd15fcd46f8b014bc4e5452be72819993bfa336d9e09ae2f283c69b4ae2

Malware Config

Extracted

Family

azorult

C2

http://185.43.220.15/~yafpn149/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • suricata: ET MALWARE AZORult Variant.4 Checkin M2

    suricata: ET MALWARE AZORult Variant.4 Checkin M2

  • suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M4

    suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M4

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe
    "C:\Users\Admin\AppData\Local\Temp\f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1836
    • C:\Users\Admin\AppData\Local\Temp\f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe
      "f30de1eaa6131b558d7ea14e86add8ec22cebb6b988715753745b12e46906901.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:908
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 908 -s 744
        3⤵
        • Program crash
        PID:1636

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/908-60-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB

        • memory/1836-54-0x00000000012E0000-0x000000000137C000-memory.dmp

          Filesize

          624KB

        • memory/1836-55-0x0000000000480000-0x00000000004AC000-memory.dmp

          Filesize

          176KB

        • memory/1836-56-0x0000000074F91000-0x0000000074F93000-memory.dmp

          Filesize

          8KB

        • memory/1836-58-0x00000000004C0000-0x00000000004C3000-memory.dmp

          Filesize

          12KB