Analysis
- max time kernel
73s - max time network
75s - platform
windows7_x64 - resource
win7-20220414-en - submitted
23/05/2022, 01:49
General
- Target fd91dbad2d19d5d622b97cb01a25d79748358664a5d26c7a81fd9031ece7777a.exe
- Size 823KB
- Sample220523-b8pnasbdf2
- SHA256 fd91dbad2d19d5d622b97cb01a25d79748358664a5d26c7a81fd9031ece7777a
Malware Config
Extracted
-
azorult
-
http://e4v5sa.xyz/PL341/index.php
Signatures
- Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd91dbad2d19d5d622b97cb01a25d79748358664a5d26c7a81fd9031ece7777a.exe"C:\Users\Admin\AppData\Local\Temp\fd91dbad2d19d5d622b97cb01a25d79748358664a5d26c7a81fd9031ece7777a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fd91dbad2d19d5d622b97cb01a25d79748358664a5d26c7a81fd9031ece7777a.exe"C:\Users\Admin\AppData\Local\Temp\fd91dbad2d19d5d622b97cb01a25d79748358664a5d26c7a81fd9031ece7777a.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1336-64-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1336-71-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1336-62-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1336-66-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1336-60-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1336-63-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1336-69-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1336-59-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1652-54-0x0000000001130000-0x0000000001204000-memory.dmp
memory/1652-55-0x0000000076461000-0x0000000076463000-memory.dmp
memory/1652-58-0x0000000000B20000-0x0000000000B82000-memory.dmp
memory/1652-57-0x0000000006080000-0x0000000006124000-memory.dmp
memory/1652-56-0x0000000000400000-0x000000000040A000-memory.dmp