Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
23/05/2022, 07:49
General
- Target 2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe
- Size 1.1MB
- Sample220523-jnpfssccf7
- SHA256 2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b
Score
10/10
Malware Config
Extracted
Family
-
azorult
C2
-
http://62.197.136.186/kendrick/index.php
Signatures
- Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
- suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M13
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M13
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe"C:\Users\Admin\AppData\Local\Temp\2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe"C:\Users\Admin\AppData\Local\Temp\2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1540-130-0x0000000000030000-0x000000000014C000-memory.dmp
memory/1540-131-0x0000000005060000-0x0000000005604000-memory.dmp
memory/1540-132-0x0000000004B50000-0x0000000004BE2000-memory.dmp
memory/1540-133-0x0000000004B10000-0x0000000004B1A000-memory.dmp
memory/1540-134-0x0000000007570000-0x000000000760C000-memory.dmp
memory/2888-136-0x0000000000400000-0x0000000000420000-memory.dmp
memory/2888-138-0x0000000000400000-0x0000000000420000-memory.dmp
memory/2888-139-0x0000000000400000-0x0000000000420000-memory.dmp