Analysis
-
max time kernel
113s -
max time network
104s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 12:31
General
-
Target
PRODUCT LIST.exe
-
Size
294KB
-
MD5
a42e195a8a3de45dc2bc88e33af006a4
-
SHA1
1ce81ed627893bb2cb4aa83b008dcd10c9203dae
-
SHA256
655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66
-
SHA512
2a08c7e3110e080d2377e7e25f7cc3f1ff936ceb5e59f5f763955578b68cafe10b8d260a6b3147d0bd6d127774a298181bca8ad6256f40a42318df31756de90c
Score
10/10
Malware Config
Extracted
Family
azorult
C2
http://217.160.254.33/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PRODUCT LIST.exe"C:\Users\Admin\AppData\Local\Temp\PRODUCT LIST.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PRODUCT LIST.exe"{path}"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
320KB
-
Filesize
8KB
-
Filesize
112KB
-
Filesize
168KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB