Analysis

  • max time kernel
    56s
  • max time network
    66s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    23/05/2022, 01:49

General

  • Target

    69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe

  • Size

    989KB

  • MD5

    06903b77d619dd25dbf161663feaa1fb

  • SHA1

    d37d0d9278fda5a7e989b1aeb384479b840ad96a

  • SHA256

    69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a

  • SHA512

    ac883ba67d5ac423922265f1f480e65a8dbb818f0efa36c2544f18c7c36e000eefa86a9dc7c950c02dc06aded44c12ed41ca72eaa99f4dc7d9d4fd53533faf2e

Malware Config

Extracted

Family

azorult

C2

http://62.197.136.186/ugonna/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M5

    suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M5

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe
    "C:\Users\Admin\AppData\Local\Temp\69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1944
    • C:\Users\Admin\AppData\Local\Temp\69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe
      "C:\Users\Admin\AppData\Local\Temp\69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1760
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 756
        3⤵
        • Program crash
        PID:1096

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1760-64-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB

        • memory/1760-63-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB

        • memory/1760-71-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB

        • memory/1760-69-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB

        • memory/1760-59-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB

        • memory/1760-60-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB

        • memory/1760-62-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB

        • memory/1760-66-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB

        • memory/1944-54-0x0000000001290000-0x000000000138E000-memory.dmp

          Filesize

          1016KB

        • memory/1944-56-0x0000000000C00000-0x0000000000C1A000-memory.dmp

          Filesize

          104KB

        • memory/1944-58-0x0000000000DC0000-0x0000000000DE2000-memory.dmp

          Filesize

          136KB

        • memory/1944-57-0x0000000008000000-0x00000000080EA000-memory.dmp

          Filesize

          936KB

        • memory/1944-55-0x0000000076171000-0x0000000076173000-memory.dmp

          Filesize

          8KB