Analysis Overview
SHA256
6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327
Threat Level: Known bad
The file 6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe was found to be: Known bad.
Malicious Activity Summary
Azorult
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M6
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M13
Suspicious use of SetThreadContext
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2022-05-23 01:49
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2022-05-23 01:49
Reported
2022-05-23 01:57
Platform
win7-20220414-en
Max time kernel
138s
Max time network
145s
Command Line
Signatures
Azorult
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M6
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1688 set thread context of 1892 | N/A | C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe | C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe
"C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe"
C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe
"C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe"
Network
| Country | Destination | Domain | Proto |
| NL | 85.202.169.121:80 | 85.202.169.121 | tcp |
Files
memory/1688-54-0x00000000013C0000-0x0000000001478000-memory.dmp
memory/1688-55-0x0000000076391000-0x0000000076393000-memory.dmp
memory/1688-56-0x0000000000630000-0x000000000064A000-memory.dmp
memory/1688-57-0x00000000054B0000-0x0000000005552000-memory.dmp
memory/1688-58-0x0000000000A40000-0x0000000000A62000-memory.dmp
memory/1892-59-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1892-60-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1892-62-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1892-63-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1892-64-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1892-66-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1892-67-0x000000000041A684-mapping.dmp
memory/1892-69-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1892-71-0x0000000000400000-0x0000000000420000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2022-05-23 01:49
Reported
2022-05-23 01:58
Platform
win10v2004-20220414-en
Max time kernel
111s
Max time network
180s
Command Line
Signatures
Azorult
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M13
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 4416 set thread context of 4188 | N/A | C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe | C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe
"C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe"
C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe
"C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe"
Network
| Country | Destination | Domain | Proto |
| BE | 67.27.153.254:80 | tcp | |
| BE | 67.27.153.254:80 | tcp | |
| NL | 85.202.169.121:80 | 85.202.169.121 | tcp |
Files
memory/4416-130-0x0000000000170000-0x0000000000228000-memory.dmp
memory/4416-131-0x00000000051C0000-0x0000000005764000-memory.dmp
memory/4416-132-0x0000000004C10000-0x0000000004CA2000-memory.dmp
memory/4416-133-0x0000000004BD0000-0x0000000004BDA000-memory.dmp
memory/4416-134-0x0000000008940000-0x00000000089DC000-memory.dmp
memory/4188-135-0x0000000000000000-mapping.dmp
memory/4188-136-0x0000000000400000-0x0000000000420000-memory.dmp
memory/4188-138-0x0000000000400000-0x0000000000420000-memory.dmp
memory/4188-139-0x0000000000400000-0x0000000000420000-memory.dmp