Analysis
-
max time kernel
45s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-07-2022 08:08
Static task
static1
Behavioral task
behavioral1
Sample
3c3e5ce6985877e985e832b5f3b9fe881c71cf7de4f891cec7a0f6a930758f8f.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3c3e5ce6985877e985e832b5f3b9fe881c71cf7de4f891cec7a0f6a930758f8f.exe
Resource
win10v2004-20220414-en
General
-
Target
3c3e5ce6985877e985e832b5f3b9fe881c71cf7de4f891cec7a0f6a930758f8f.exe
-
Size
4.6MB
-
MD5
41c1385121b1c992fb938e297d0afcc8
-
SHA1
ecf24ccd2a94799bd637d7b3d2b5d734b95189f0
-
SHA256
3c3e5ce6985877e985e832b5f3b9fe881c71cf7de4f891cec7a0f6a930758f8f
-
SHA512
33fda8b803d7fd637c61409a990fcbdc1988f7e99f0459b550c21312e0d9c510e41b35b44435b0d4126aea8dbc8d554f28e3f5e3bab1e4ac9d3798e5d8e4a1fb
Malware Config
Extracted
azorult
http://51.75.24.146/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M6
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M6
-
Loads dropped DLL 1 IoCs
Processes:
3c3e5ce6985877e985e832b5f3b9fe881c71cf7de4f891cec7a0f6a930758f8f.exepid process 1792 3c3e5ce6985877e985e832b5f3b9fe881c71cf7de4f891cec7a0f6a930758f8f.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
3c3e5ce6985877e985e832b5f3b9fe881c71cf7de4f891cec7a0f6a930758f8f.exedescription pid process Token: 33 1792 3c3e5ce6985877e985e832b5f3b9fe881c71cf7de4f891cec7a0f6a930758f8f.exe Token: SeIncBasePriorityPrivilege 1792 3c3e5ce6985877e985e832b5f3b9fe881c71cf7de4f891cec7a0f6a930758f8f.exe Token: 33 1792 3c3e5ce6985877e985e832b5f3b9fe881c71cf7de4f891cec7a0f6a930758f8f.exe Token: SeIncBasePriorityPrivilege 1792 3c3e5ce6985877e985e832b5f3b9fe881c71cf7de4f891cec7a0f6a930758f8f.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
3c3e5ce6985877e985e832b5f3b9fe881c71cf7de4f891cec7a0f6a930758f8f.exepid process 1792 3c3e5ce6985877e985e832b5f3b9fe881c71cf7de4f891cec7a0f6a930758f8f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c3e5ce6985877e985e832b5f3b9fe881c71cf7de4f891cec7a0f6a930758f8f.exe"C:\Users\Admin\AppData\Local\Temp\3c3e5ce6985877e985e832b5f3b9fe881c71cf7de4f891cec7a0f6a930758f8f.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Turbo.net\Sandbox\Wise Data Recovery \4.0.7 \local\temp\1792_00400000_tls.dllFilesize
1024B
MD5eb23168ee6b406bb07d98c212799a839
SHA126168b76af02d8c855cb3b93560a81bd09d782c7
SHA2565ba6d143bfac6c3c190ae0f6fab1cb168ea04d1ec7e202a80c502e773ca392d7
SHA512bedb9266fecab4e4ee749a2720795b54abe11e99ca7747e9b9ff0615d112e23250d1223fe663a24feb591b6d804557158f891d9ba826924005fec8d6927d2eb8
-
memory/1792-66-0x0000000010000000-0x0000000010099000-memory.dmpFilesize
612KB
-
memory/1792-122-0x0000000076CB0000-0x0000000076DC0000-memory.dmpFilesize
1.1MB
-
memory/1792-59-0x0000000000C00000-0x0000000001085000-memory.dmpFilesize
4.5MB
-
memory/1792-58-0x0000000000C00000-0x0000000001085000-memory.dmpFilesize
4.5MB
-
memory/1792-60-0x0000000000C00000-0x0000000001085000-memory.dmpFilesize
4.5MB
-
memory/1792-61-0x0000000000C00000-0x0000000001085000-memory.dmpFilesize
4.5MB
-
memory/1792-62-0x0000000000C00000-0x0000000001085000-memory.dmpFilesize
4.5MB
-
memory/1792-71-0x0000000010000000-0x0000000010099000-memory.dmpFilesize
612KB
-
memory/1792-121-0x0000000000C00000-0x0000000001085000-memory.dmpFilesize
4.5MB
-
memory/1792-57-0x0000000000C00000-0x0000000001085000-memory.dmpFilesize
4.5MB
-
memory/1792-63-0x0000000000C00000-0x0000000001085000-memory.dmpFilesize
4.5MB
-
memory/1792-72-0x0000000000400000-0x00000000005CD000-memory.dmpFilesize
1.8MB
-
memory/1792-56-0x0000000000C00000-0x0000000001085000-memory.dmpFilesize
4.5MB
-
memory/1792-119-0x0000000074F40000-0x0000000074F42000-memory.dmpFilesize
8KB
-
memory/1792-120-0x0000000000400000-0x00000000005F9000-memory.dmpFilesize
2.0MB
-
memory/1792-118-0x0000000076CB0000-0x0000000076DC0000-memory.dmpFilesize
1.1MB
-
memory/1792-117-0x0000000000C00000-0x0000000001085000-memory.dmpFilesize
4.5MB
-
memory/1792-55-0x0000000075AE1000-0x0000000075AE3000-memory.dmpFilesize
8KB
-
memory/1792-123-0x0000000000400000-0x00000000005CD000-memory.dmpFilesize
1.8MB
-
memory/1792-65-0x0000000000C00000-0x0000000001085000-memory.dmpFilesize
4.5MB