Analysis
- max time kernel
124s - max time network
132s - platform
windows7_x64 - resource
win7-20220414-en - submitted
21/05/2022, 00:55
General
- Target PICTURE FOR ILLUSTRATION.exe
- Size 263KB
- Sample220521-a9rcvaeegn
- SHA256 5447c2be0b0ec772c186a81fc56b8b1b30827b5298f1b05a9d6cb70e31a6901d
Malware Config
Extracted
-
azorult
-
http://51.116.180.53/index.php
Signatures
- Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PICTURE FOR ILLUSTRATION.exe"C:\Users\Admin\AppData\Local\Temp\PICTURE FOR ILLUSTRATION.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PICTURE FOR ILLUSTRATION.exe"{path}"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1108-54-0x0000000076721000-0x0000000076723000-memory.dmp
memory/1108-55-0x0000000074A50000-0x0000000074FFB000-memory.dmp
memory/1288-56-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1288-57-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1288-59-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1288-60-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1288-61-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1288-63-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1288-66-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1288-68-0x0000000000400000-0x0000000000420000-memory.dmp