Analysis
-
max time kernel
104s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
23/05/2022, 01:49
Static task
static1
Behavioral task
behavioral1
Sample
fd91dbad2d19d5d622b97cb01a25d79748358664a5d26c7a81fd9031ece7777a.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
fd91dbad2d19d5d622b97cb01a25d79748358664a5d26c7a81fd9031ece7777a.exe
Resource
win10v2004-20220414-en
General
-
Target
fd91dbad2d19d5d622b97cb01a25d79748358664a5d26c7a81fd9031ece7777a.exe
-
Size
823KB
-
MD5
40017083380e6ee7bf6c3c585d52cc3a
-
SHA1
f8721e36967fc8a3d275d7afdea9c6100af04343
-
SHA256
fd91dbad2d19d5d622b97cb01a25d79748358664a5d26c7a81fd9031ece7777a
-
SHA512
fdde3766a4535503e7ff5578424cdb1ecabf408b0c341cf68ffd150dda3bea56ac4102e5d43de8067ee50cf1d603c1bb5218962356afec094c6f5fe466a77cbe
Malware Config
Extracted
azorult
http://e4v5sa.xyz/PL341/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3692 set thread context of 3168 3692 fd91dbad2d19d5d622b97cb01a25d79748358664a5d26c7a81fd9031ece7777a.exe 87 -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3692 wrote to memory of 3168 3692 fd91dbad2d19d5d622b97cb01a25d79748358664a5d26c7a81fd9031ece7777a.exe 87 PID 3692 wrote to memory of 3168 3692 fd91dbad2d19d5d622b97cb01a25d79748358664a5d26c7a81fd9031ece7777a.exe 87 PID 3692 wrote to memory of 3168 3692 fd91dbad2d19d5d622b97cb01a25d79748358664a5d26c7a81fd9031ece7777a.exe 87 PID 3692 wrote to memory of 3168 3692 fd91dbad2d19d5d622b97cb01a25d79748358664a5d26c7a81fd9031ece7777a.exe 87 PID 3692 wrote to memory of 3168 3692 fd91dbad2d19d5d622b97cb01a25d79748358664a5d26c7a81fd9031ece7777a.exe 87 PID 3692 wrote to memory of 3168 3692 fd91dbad2d19d5d622b97cb01a25d79748358664a5d26c7a81fd9031ece7777a.exe 87 PID 3692 wrote to memory of 3168 3692 fd91dbad2d19d5d622b97cb01a25d79748358664a5d26c7a81fd9031ece7777a.exe 87 PID 3692 wrote to memory of 3168 3692 fd91dbad2d19d5d622b97cb01a25d79748358664a5d26c7a81fd9031ece7777a.exe 87 PID 3692 wrote to memory of 3168 3692 fd91dbad2d19d5d622b97cb01a25d79748358664a5d26c7a81fd9031ece7777a.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd91dbad2d19d5d622b97cb01a25d79748358664a5d26c7a81fd9031ece7777a.exe"C:\Users\Admin\AppData\Local\Temp\fd91dbad2d19d5d622b97cb01a25d79748358664a5d26c7a81fd9031ece7777a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\fd91dbad2d19d5d622b97cb01a25d79748358664a5d26c7a81fd9031ece7777a.exe"C:\Users\Admin\AppData\Local\Temp\fd91dbad2d19d5d622b97cb01a25d79748358664a5d26c7a81fd9031ece7777a.exe"2⤵PID:3168
-