Analysis
- max time kernel
58s - max time network
62s - platform
windows7_x64 - resource
win7-20220414-en - submitted
23/05/2022, 07:49
General
- Target 347f567cb5c6b3dca3f5efb98af1e19acead36394eb2c7288fc9672f8323b089.exe
- Size 1.1MB
- Sample220523-jnpfssffdl
- SHA256 347f567cb5c6b3dca3f5efb98af1e19acead36394eb2c7288fc9672f8323b089
Malware Config
Extracted
-
azorult
-
http://bl1we4t.xyz/index.php
Signatures
- Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\347f567cb5c6b3dca3f5efb98af1e19acead36394eb2c7288fc9672f8323b089.exe"C:\Users\Admin\AppData\Local\Temp\347f567cb5c6b3dca3f5efb98af1e19acead36394eb2c7288fc9672f8323b089.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\347f567cb5c6b3dca3f5efb98af1e19acead36394eb2c7288fc9672f8323b089.exe"C:\Users\Admin\AppData\Local\Temp\347f567cb5c6b3dca3f5efb98af1e19acead36394eb2c7288fc9672f8323b089.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1092-54-0x0000000000F60000-0x0000000001080000-memory.dmp
memory/1092-55-0x00000000765C1000-0x00000000765C3000-memory.dmp
memory/1092-56-0x0000000000550000-0x000000000055A000-memory.dmp
memory/1092-57-0x0000000005FE0000-0x00000000060CC000-memory.dmp
memory/1092-58-0x0000000000AD0000-0x0000000000AF2000-memory.dmp
memory/1768-59-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1768-60-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1768-62-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1768-63-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1768-64-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1768-66-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1768-69-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1768-71-0x0000000000400000-0x0000000000420000-memory.dmp