Analysis
-
max time kernel
138s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 19:02
Static task
static1
Behavioral task
behavioral1
Sample
21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe
Resource
win10v2004-20220812-en
General
-
Target
21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe
-
Size
516KB
-
MD5
b9d619b9b382accbc2aa81f4023baf3f
-
SHA1
e9cc5b7fca5e3c70bf1c66827f7a59e3171359dc
-
SHA256
21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0
-
SHA512
4005a2a29c774035da22e825bda67c3af5ea594ff87876e5cbf9e5b5878eca083a27191bbe53adfa25fec26fc1afe5b5e04bf45efc50acf6acc692c2ed90d70f
-
SSDEEP
12288:g4ElE9n4ixRxYeFqrMDQ9g5QssZsQ7xViHQEx2h3ns:yA8qQ9WsGgaw3hXs
Malware Config
Extracted
azorult
http://pa-magelang.go.id/FTP/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exedescription pid process target process PID 4812 set thread context of 2660 4812 21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe 21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 680 2660 WerFault.exe 21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exepid process 4812 21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe 4812 21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe 4812 21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exedescription pid process Token: SeDebugPrivilege 4812 21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exedescription pid process target process PID 4812 wrote to memory of 1520 4812 21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe 21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe PID 4812 wrote to memory of 1520 4812 21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe 21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe PID 4812 wrote to memory of 1520 4812 21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe 21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe PID 4812 wrote to memory of 2660 4812 21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe 21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe PID 4812 wrote to memory of 2660 4812 21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe 21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe PID 4812 wrote to memory of 2660 4812 21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe 21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe PID 4812 wrote to memory of 2660 4812 21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe 21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe PID 4812 wrote to memory of 2660 4812 21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe 21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe PID 4812 wrote to memory of 2660 4812 21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe 21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe PID 4812 wrote to memory of 2660 4812 21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe 21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe PID 4812 wrote to memory of 2660 4812 21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe 21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe PID 4812 wrote to memory of 2660 4812 21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe 21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe"C:\Users\Admin\AppData\Local\Temp\21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\21644e10ce3947d4154ad546bfc8e065e0baaa120bf4e20e38d076bdae3022a0.exe"{path}"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 13043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2660 -ip 26601⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1520-137-0x0000000000000000-mapping.dmp
-
memory/2660-138-0x0000000000000000-mapping.dmp
-
memory/2660-139-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2660-141-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2660-142-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2660-143-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2660-144-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4812-132-0x0000000000A40000-0x0000000000AC8000-memory.dmpFilesize
544KB
-
memory/4812-133-0x0000000005A80000-0x0000000006024000-memory.dmpFilesize
5.6MB
-
memory/4812-134-0x00000000054D0000-0x0000000005562000-memory.dmpFilesize
584KB
-
memory/4812-135-0x0000000005480000-0x000000000548A000-memory.dmpFilesize
40KB
-
memory/4812-136-0x0000000008BF0000-0x0000000008C8C000-memory.dmpFilesize
624KB