Overview

overview

10

Static

static

Pedido Con...df.exe

windows7-x64

10

Pedido Con...df.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    91s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-10-2022 07:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Pedido Conman Argentina S.A.L_PR-211299,pdf.exe

  • Size

    157KB

  • MD5

    8043e2111c71b1a98a70899dd133c2e3

  • SHA1

    a2519ce801d557ff3e6f34b7df10ac48c0233e9f

  • SHA256

    2c4c53968b0844bfdedf92c1d22a10987d8e0817e47602c1bc0be74762d88ce2

  • SHA512

    282fb8e1aca54b7db5390ed2b703f9c0dba32781b52c513462932c6476b87e3269c1be74583c7a1f2b60f4b123f4d1d0f6cce58ec191d0443ab18c902d0fc849

  • SSDEEP

    3072:clHKJVlxcnu4XGWyzvSeZcRpXygLGJUwbHC7K5+DdabGqu0jf:qK3lunu2xcvlGpigSJNDej5abH7

Score
10/10
azorultinfostealertrojan

Malware Config

Extracted

Family

azorult

C2

http://blsrsr.shop/PL341/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Pedido Conman Argentina S.A.L_PR-211299,pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\Pedido Conman Argentina S.A.L_PR-211299,pdf.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4644
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regsvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regsvcs.exe"
      2⤵
        PID:520
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regsvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Regsvcs.exe"
        2⤵
          PID:4512

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/520-136-0x0000000000000000-mapping.dmp
        Download
      • memory/4512-137-0x0000000000000000-mapping.dmp
        Download
      • memory/4512-138-0x0000000000400000-0x0000000000420000-memory.dmp
        Filesize

        128KB

        Download
      • memory/4512-140-0x0000000000400000-0x0000000000420000-memory.dmp
        Filesize

        128KB

        Download
      • memory/4512-141-0x0000000000400000-0x0000000000420000-memory.dmp
        Filesize

        128KB

        Download
      • memory/4644-135-0x0000000000890000-0x00000000008BA000-memory.dmp
        Filesize

        168KB

        Download