Analysis
-
max time kernel
136s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
30-11-2022 16:47
General
-
Target
6a7b530ce7035af9262e414949058513e9f0db341244250af03b8d932d7c47c3.exe
-
Size
710KB
-
MD5
919c771d279135f6474abdc43fc603d9
-
SHA1
9054198117ee9da213dcfcf5bddbd3611affb7f3
-
SHA256
6a7b530ce7035af9262e414949058513e9f0db341244250af03b8d932d7c47c3
-
SHA512
44bfb241516f5ac2c508c7bf2da54f814d61f32b0622745edd333f0cf2233038c571e7c0a3e4f5362138728446dbd8f79762f5fb30f12cc452ee388adfeb5fab
-
SSDEEP
12288:G8pRdFTK9K7lZncxtEgwDuoljBZcPIJrK7uXAq+Q3jurBw9TsrGguVNLXM1:NOK5ZncxtEgwDuolYPveAqd3jGw9Tu0S
Score
10/10
Malware Config
Extracted
Family
azorult
C2
http://hapuget.host/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a7b530ce7035af9262e414949058513e9f0db341244250af03b8d932d7c47c3.exe"C:\Users\Admin\AppData\Local\Temp\6a7b530ce7035af9262e414949058513e9f0db341244250af03b8d932d7c47c3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/544-132-0x0000000000000000-mapping.dmp
-
memory/1048-133-0x0000000003750000-0x00000000037CA000-memory.dmpFilesize
488KB
-
memory/1048-134-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB