Analysis
- max time kernel
48s - max time network
51s - platform
windows7_x64 - resource
win7-20220414-en - submitted
23/05/2022, 07:49
General
- Target 2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe
- Size 1.1MB
- Sample220523-jnpfssccf7
- SHA256 2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b
Malware Config
Extracted
-
azorult
-
http://62.197.136.186/kendrick/index.php
Signatures
- Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
- suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M5
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M5
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe"C:\Users\Admin\AppData\Local\Temp\2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe"C:\Users\Admin\AppData\Local\Temp\2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/940-64-0x0000000000400000-0x0000000000420000-memory.dmp
memory/940-66-0x0000000000400000-0x0000000000420000-memory.dmp
memory/940-71-0x0000000000400000-0x0000000000420000-memory.dmp
memory/940-62-0x0000000000400000-0x0000000000420000-memory.dmp
memory/940-59-0x0000000000400000-0x0000000000420000-memory.dmp
memory/940-63-0x0000000000400000-0x0000000000420000-memory.dmp
memory/940-69-0x0000000000400000-0x0000000000420000-memory.dmp
memory/940-60-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1084-54-0x0000000000E90000-0x0000000000FAC000-memory.dmp
memory/1084-55-0x0000000075CF1000-0x0000000075CF3000-memory.dmp
memory/1084-58-0x00000000007F0000-0x0000000000812000-memory.dmp
memory/1084-57-0x0000000005B40000-0x0000000005C2C000-memory.dmp
memory/1084-56-0x0000000000740000-0x0000000000752000-memory.dmp