Analysis
- max time kernel
86s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
01/06/2022, 21:31
General
- Target 056b1b056504fbd03dc32668dbf3fa52900685da42d1d47a75e9d150a8f23713.exe
- Size 483KB
- Sample220601-1dackabgd2
- SHA256 056b1b056504fbd03dc32668dbf3fa52900685da42d1d47a75e9d150a8f23713
Malware Config
Extracted
-
azorult
-
http://swi54.xyz/swi341/index.php
Signatures
- Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\056b1b056504fbd03dc32668dbf3fa52900685da42d1d47a75e9d150a8f23713.exe"C:\Users\Admin\AppData\Local\Temp\056b1b056504fbd03dc32668dbf3fa52900685da42d1d47a75e9d150a8f23713.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\056b1b056504fbd03dc32668dbf3fa52900685da42d1d47a75e9d150a8f23713.exe"{path}"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\056b1b056504fbd03dc32668dbf3fa52900685da42d1d47a75e9d150a8f23713.exe"{path}"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\056b1b056504fbd03dc32668dbf3fa52900685da42d1d47a75e9d150a8f23713.exe"{path}"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4520-139-0x0000000000400000-0x0000000000420000-memory.dmp
memory/4520-141-0x0000000000400000-0x0000000000420000-memory.dmp
memory/4520-145-0x0000000000400000-0x0000000000420000-memory.dmp
memory/4788-133-0x00000000753F0000-0x00000000759A1000-memory.dmp
memory/4788-134-0x00000000741F0000-0x0000000074CF0000-memory.dmp
memory/4788-135-0x00000000739C0000-0x0000000074168000-memory.dmp
memory/4788-132-0x00000000739C0000-0x0000000074168000-memory.dmp
memory/4788-131-0x00000000741F0000-0x0000000074CF0000-memory.dmp
memory/4788-130-0x00000000753F0000-0x00000000759A1000-memory.dmp
memory/4788-142-0x00000000753F0000-0x00000000759A1000-memory.dmp
memory/4788-143-0x00000000741F0000-0x0000000074CF0000-memory.dmp
memory/4788-144-0x00000000739C0000-0x0000000074168000-memory.dmp