Analysis
- max time kernel
43s - max time network
46s - platform
windows7_x64 - resource
win7-20220414-en - submitted
02/06/2022, 10:43
General
- Target SecuriteInfo.com.Variant.MSILHeracles.38917.23524.exe
- Size 693KB
- Sample220602-msghjaafgl
- SHA256 d9d149954cd130fcab001db9a191bac89c5cebe94744cc8a7ef64b9f1a8a81a8
Malware Config
Extracted
-
azorult
-
http://84.38.129.36//index.php
Signatures
- Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
- suricata: ET MALWARE AZORult Variant.4 Checkin M2
suricata: ET MALWARE AZORult Variant.4 Checkin M2
- suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M4
suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M4
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.MSILHeracles.38917.23524.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.MSILHeracles.38917.23524.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.MSILHeracles.38917.23524.exe"{path}"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1376-70-0x0000000000D50000-0x0000000000DC4000-memory.dmp
memory/1376-71-0x0000000000CC0000-0x0000000000CE2000-memory.dmp
memory/1376-56-0x0000000072A20000-0x0000000073DAF000-memory.dmp
memory/1376-57-0x0000000072010000-0x0000000072A20000-memory.dmp
memory/1376-58-0x00000000745D0000-0x0000000074764000-memory.dmp
memory/1376-59-0x00000000712F0000-0x000000007200D000-memory.dmp
memory/1376-60-0x0000000070B10000-0x00000000712F0000-memory.dmp
memory/1376-61-0x00000000743F0000-0x00000000745C1000-memory.dmp
memory/1376-62-0x00000000742D0000-0x00000000743CC000-memory.dmp
memory/1376-63-0x00000000003A0000-0x00000000003AA000-memory.dmp
memory/1376-64-0x00000000703D0000-0x0000000070B0E000-memory.dmp
memory/1376-65-0x0000000072A20000-0x0000000073DAF000-memory.dmp
memory/1376-66-0x0000000072010000-0x0000000072A20000-memory.dmp
memory/1376-67-0x00000000745D0000-0x0000000074764000-memory.dmp
memory/1376-68-0x00000000712F0000-0x000000007200D000-memory.dmp
memory/1376-69-0x00000000743F0000-0x00000000745C1000-memory.dmp
memory/1376-55-0x0000000075AE1000-0x0000000075AE3000-memory.dmp
memory/1376-88-0x00000000743F0000-0x00000000745C1000-memory.dmp
memory/1376-54-0x00000000011F0000-0x00000000012A4000-memory.dmp
memory/1376-87-0x00000000712F0000-0x000000007200D000-memory.dmp
memory/1376-85-0x0000000072010000-0x0000000072A20000-memory.dmp
memory/1376-86-0x00000000745D0000-0x0000000074764000-memory.dmp
memory/1376-84-0x0000000072A20000-0x0000000073DAF000-memory.dmp
memory/1552-77-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1552-82-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1552-79-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1552-76-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1552-75-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1552-72-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1552-73-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1552-89-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1552-90-0x0000000000400000-0x0000000000420000-memory.dmp