Analysis

  • max time kernel
    153s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    23/05/2022, 01:49

General

  • Target

    69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe

  • Size

    989KB

  • MD5

    06903b77d619dd25dbf161663feaa1fb

  • SHA1

    d37d0d9278fda5a7e989b1aeb384479b840ad96a

  • SHA256

    69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a

  • SHA512

    ac883ba67d5ac423922265f1f480e65a8dbb818f0efa36c2544f18c7c36e000eefa86a9dc7c950c02dc06aded44c12ed41ca72eaa99f4dc7d9d4fd53533faf2e

Malware Config

Extracted

Family

azorult

C2

http://62.197.136.186/ugonna/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M15

    suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M15

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe
    "C:\Users\Admin\AppData\Local\Temp\69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1820
    • C:\Users\Admin\AppData\Local\Temp\69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe
      "C:\Users\Admin\AppData\Local\Temp\69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe"
      2⤵
        PID:4432
      • C:\Users\Admin\AppData\Local\Temp\69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe
        "C:\Users\Admin\AppData\Local\Temp\69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe"
        2⤵
          PID:3828
        • C:\Users\Admin\AppData\Local\Temp\69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe
          "C:\Users\Admin\AppData\Local\Temp\69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe"
          2⤵
            PID:4520
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 996
              3⤵
              • Program crash
              PID:3772
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 4520 -ip 4520
          1⤵
            PID:4976

          Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • memory/1820-130-0x0000000000870000-0x000000000096E000-memory.dmp

                  Filesize

                  1016KB

                • memory/1820-131-0x00000000059F0000-0x0000000005F94000-memory.dmp

                  Filesize

                  5.6MB

                • memory/1820-132-0x0000000005300000-0x0000000005392000-memory.dmp

                  Filesize

                  584KB

                • memory/1820-133-0x00000000053B0000-0x00000000053BA000-memory.dmp

                  Filesize

                  40KB

                • memory/1820-134-0x0000000008F10000-0x0000000008FAC000-memory.dmp

                  Filesize

                  624KB

                • memory/4520-138-0x0000000000400000-0x0000000000420000-memory.dmp

                  Filesize

                  128KB

                • memory/4520-140-0x0000000000400000-0x0000000000420000-memory.dmp

                  Filesize

                  128KB

                • memory/4520-141-0x0000000000400000-0x0000000000420000-memory.dmp

                  Filesize

                  128KB