Behavioral task
behavioral1
Sample
2020-59-0x0000000000400000-0x0000000000420000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2020-59-0x0000000000400000-0x0000000000420000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
2020-59-0x0000000000400000-0x0000000000420000-memory.dmp
-
Size
128KB
-
MD5
7f337f552248b6b1a819535af7e24653
-
SHA1
bda350272a8576edf23a00f6c7a394f55a75041f
-
SHA256
3516b71e8af861c1342ad11e7905eb68874a57d24eca40e56d1d08705c1dae07
-
SHA512
12f27f7e4d12a67ebd7c4d3e33ccf54c5f9c25fa7943cfb4441e2497886274479890476bd601b620c24d3b3b74609f7833c57898675f5228f02863f1626618a7
-
SSDEEP
3072:tuOSXpMx7ZAlHsbfUkolNGti7lfqeSxM3SpyEY3E/:Zzx7ZApszolIo7lf/ipT/
Malware Config
Extracted
azorult
http://64.52.171.230/index.php
Signatures
-
Azorult family
Files
-
2020-59-0x0000000000400000-0x0000000000420000-memory.dmp.exe windows x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 101KB - Virtual size: 100KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 2KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ