Analysis

  • max time kernel
    115s
  • max time network
    106s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    23/05/2022, 01:49

General

  • Target

    5b717086c5e6afdecbc1bcd7b139eda033de89dfafc397e26e33138e3e2693d5.exe

  • Size

    271KB

  • MD5

    ebf990d08c9d277607ab0a152fb855a7

  • SHA1

    561628b5bac3aada8764c58fd9d2a0a5a8d4a978

  • SHA256

    5b717086c5e6afdecbc1bcd7b139eda033de89dfafc397e26e33138e3e2693d5

  • SHA512

    7157bac3abfce87a9ddd3f4cee3ca3e2f06aa4a15a3167fa9c9f11199930fb96780dcf070ab9e4b548fb7742e9a0f974b45465fae39cf292b6f3a3b1f2c28497

Malware Config

Extracted

Family

azorult

C2

http://62.197.136.120/purelogs/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

Processes

  • C:\Users\Admin\AppData\Local\Temp\5b717086c5e6afdecbc1bcd7b139eda033de89dfafc397e26e33138e3e2693d5.exe
    "C:\Users\Admin\AppData\Local\Temp\5b717086c5e6afdecbc1bcd7b139eda033de89dfafc397e26e33138e3e2693d5.exe"
    1⤵
      PID:548

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/548-55-0x0000000000220000-0x000000000023D000-memory.dmp

            Filesize

            116KB

          • memory/548-54-0x000000000057E000-0x000000000058F000-memory.dmp

            Filesize

            68KB

          • memory/548-56-0x0000000000400000-0x0000000000475000-memory.dmp

            Filesize

            468KB

          • memory/548-57-0x0000000075D21000-0x0000000075D23000-memory.dmp

            Filesize

            8KB