Analysis

  • max time kernel
    73s
  • max time network
    75s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    23/05/2022, 01:49

General

  • Target

    fd91dbad2d19d5d622b97cb01a25d79748358664a5d26c7a81fd9031ece7777a.exe

  • Size

    823KB

  • MD5

    40017083380e6ee7bf6c3c585d52cc3a

  • SHA1

    f8721e36967fc8a3d275d7afdea9c6100af04343

  • SHA256

    fd91dbad2d19d5d622b97cb01a25d79748358664a5d26c7a81fd9031ece7777a

  • SHA512

    fdde3766a4535503e7ff5578424cdb1ecabf408b0c341cf68ffd150dda3bea56ac4102e5d43de8067ee50cf1d603c1bb5218962356afec094c6f5fe466a77cbe

Malware Config

Extracted

Family

azorult

C2

http://e4v5sa.xyz/PL341/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fd91dbad2d19d5d622b97cb01a25d79748358664a5d26c7a81fd9031ece7777a.exe
    "C:\Users\Admin\AppData\Local\Temp\fd91dbad2d19d5d622b97cb01a25d79748358664a5d26c7a81fd9031ece7777a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1652
    • C:\Users\Admin\AppData\Local\Temp\fd91dbad2d19d5d622b97cb01a25d79748358664a5d26c7a81fd9031ece7777a.exe
      "C:\Users\Admin\AppData\Local\Temp\fd91dbad2d19d5d622b97cb01a25d79748358664a5d26c7a81fd9031ece7777a.exe"
      2⤵
        PID:1336

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1336-64-0x0000000000400000-0x0000000000420000-memory.dmp

            Filesize

            128KB

          • memory/1336-71-0x0000000000400000-0x0000000000420000-memory.dmp

            Filesize

            128KB

          • memory/1336-62-0x0000000000400000-0x0000000000420000-memory.dmp

            Filesize

            128KB

          • memory/1336-66-0x0000000000400000-0x0000000000420000-memory.dmp

            Filesize

            128KB

          • memory/1336-60-0x0000000000400000-0x0000000000420000-memory.dmp

            Filesize

            128KB

          • memory/1336-63-0x0000000000400000-0x0000000000420000-memory.dmp

            Filesize

            128KB

          • memory/1336-69-0x0000000000400000-0x0000000000420000-memory.dmp

            Filesize

            128KB

          • memory/1336-59-0x0000000000400000-0x0000000000420000-memory.dmp

            Filesize

            128KB

          • memory/1652-54-0x0000000001130000-0x0000000001204000-memory.dmp

            Filesize

            848KB

          • memory/1652-55-0x0000000076461000-0x0000000076463000-memory.dmp

            Filesize

            8KB

          • memory/1652-58-0x0000000000B20000-0x0000000000B82000-memory.dmp

            Filesize

            392KB

          • memory/1652-57-0x0000000006080000-0x0000000006124000-memory.dmp

            Filesize

            656KB

          • memory/1652-56-0x0000000000400000-0x000000000040A000-memory.dmp

            Filesize

            40KB