Overview
overview
10Static
static
101.exe
windows7-x64
31221.exe
windows7-x64
106b282d34fv2.exe
windows7-x64
1B000CEF.exe
windows7-x64
10Builder.exe
windows7-x64
1POVOFJYqCo...Iu.exe
windows7-x64
1Terracotta.exe
windows7-x64
1TerracottaGUI.exe
windows7-x64
1Zver.exe
windows7-x64
3a.exe
windows7-x64
10amdcontroller.exe
windows7-x64
10bg.exe
windows7-x64
1bin.exe
windows7-x64
10bin2.exe
windows7-x64
7ej.exe
windows7-x64
10fban4.exe
windows7-x64
7glash.exe
windows7-x64
1johngotovo (2).exe
windows7-x64
10johngotovo...al.exe
windows7-x64
10ktg.exe
windows7-x64
1otIXAOPqOV...LX.exe
windows7-x64
3scvsots.exe
windows7-x64
10setup.exe
windows7-x64
1shit.exe
windows7-x64
10ss.exe
windows7-x64
10stealedd517v2.exe
windows7-x64
1steel.exe
windows7-x64
1ted.exe
windows7-x64
1update_b.exe
windows7-x64
1update_z.exe
windows7-x64
1uyo.exe
windows7-x64
1v72d8z2.exe
windows7-x64
1Analysis
-
max time kernel
20s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
13-08-2023 18:33
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
1221.exe
Resource
win7-20230712-en
Behavioral task
behavioral3
Sample
6b282d34fv2.exe
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
B000CEF.exe
Resource
win7-20230712-en
Behavioral task
behavioral5
Sample
Builder.exe
Resource
win7-20230712-en
Behavioral task
behavioral6
Sample
POVOFJYqCoZfOoPkWOsSBcVYWIu.exe
Resource
win7-20230712-en
Behavioral task
behavioral7
Sample
Terracotta.exe
Resource
win7-20230712-en
Behavioral task
behavioral8
Sample
TerracottaGUI.exe
Resource
win7-20230712-en
Behavioral task
behavioral9
Sample
Zver.exe
Resource
win7-20230712-en
Behavioral task
behavioral10
Sample
a.exe
Resource
win7-20230712-en
Behavioral task
behavioral11
Sample
amdcontroller.exe
Resource
win7-20230712-en
Behavioral task
behavioral12
Sample
bg.exe
Resource
win7-20230712-en
Behavioral task
behavioral13
Sample
bin.exe
Resource
win7-20230712-en
Behavioral task
behavioral14
Sample
bin2.exe
Resource
win7-20230712-en
Behavioral task
behavioral15
Sample
ej.exe
Resource
win7-20230712-en
Behavioral task
behavioral16
Sample
fban4.exe
Resource
win7-20230712-en
Behavioral task
behavioral17
Sample
glash.exe
Resource
win7-20230712-en
Behavioral task
behavioral18
Sample
johngotovo (2).exe
Resource
win7-20230712-en
Behavioral task
behavioral19
Sample
johngotovo (2)_original_original.exe
Resource
win7-20230712-en
Behavioral task
behavioral20
Sample
ktg.exe
Resource
win7-20230712-en
Behavioral task
behavioral21
Sample
otIXAOPqOVgvIKePlwFQLX.exe
Resource
win7-20230712-en
Behavioral task
behavioral22
Sample
scvsots.exe
Resource
win7-20230712-en
Behavioral task
behavioral23
Sample
setup.exe
Resource
win7-20230712-en
Behavioral task
behavioral24
Sample
shit.exe
Resource
win7-20230712-en
Behavioral task
behavioral25
Sample
ss.exe
Resource
win7-20230712-en
Behavioral task
behavioral26
Sample
stealedd517v2.exe
Resource
win7-20230712-en
Behavioral task
behavioral27
Sample
steel.exe
Resource
win7-20230712-en
Behavioral task
behavioral28
Sample
ted.exe
Resource
win7-20230712-en
Behavioral task
behavioral29
Sample
update_b.exe
Resource
win7-20230712-en
Behavioral task
behavioral30
Sample
update_z.exe
Resource
win7-20230712-en
Behavioral task
behavioral31
Sample
uyo.exe
Resource
win7-20230712-en
Behavioral task
behavioral32
Sample
v72d8z2.exe
Resource
win7-20230712-en
General
-
Target
johngotovo (2)_original_original.exe
-
Size
2.6MB
-
MD5
7cc005bf1923f56d495fd9de362f4f0e
-
SHA1
ee9ee7221a40c86f35437bf70372a638494e01d5
-
SHA256
c0a6c5b64a00af256ea44c2390f4b533cb7a972ea039152ab9e81fef0df2670a
-
SHA512
6a5dad75958d0fae6b0e4ccf41268187bbe3805fb27c9808a9198b310963df8f1956f9acc394923c312e7b17bf133bc4ebeb10374467ed5d99ef2b2485a37a11
-
SSDEEP
49152:KcNRa+mO3X9Qp7ZysBDVPdiw8fM96HOOP2qxuqGSJ+1lInYq6rpyxyD5nrnVvXzD:KcSg967ZHrxV96HV/fGS0IpIDtJXzdSe
Malware Config
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
johngotovo (2)_original_original.exedescription pid process Token: 33 2164 johngotovo (2)_original_original.exe Token: SeIncBasePriorityPrivilege 2164 johngotovo (2)_original_original.exe Token: 33 2164 johngotovo (2)_original_original.exe Token: SeIncBasePriorityPrivilege 2164 johngotovo (2)_original_original.exe Token: 33 2164 johngotovo (2)_original_original.exe Token: SeIncBasePriorityPrivilege 2164 johngotovo (2)_original_original.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
johngotovo (2)_original_original.exepid process 2164 johngotovo (2)_original_original.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Turbo.net\Sandbox\GOVNO\8.4.1.1\xsandbox.binFilesize
16B
MD5ec3d19e8e9b05d025cb56c2a98ead8e7
SHA1748532edeb86496c8efe5e2327501d89ec1f13df
SHA256edb7be3ef6098a1e24d0c72bbc6f968dea773951a0dd07b63bad6d9009ae3bf4
SHA512175fb8432472b6795bb5db0eba61bc7b57331720825df5b048f3086815ba844df4f7e83e42ff9e8fe5ab01700675a774cb916677953d6e0088ffbf1fa2775349
-
memory/2164-96-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2164-64-0x00000000009C0000-0x0000000000D0A000-memory.dmpFilesize
3.3MB
-
memory/2164-62-0x0000000076C80000-0x0000000076D90000-memory.dmpFilesize
1.1MB
-
memory/2164-55-0x00000000009C0000-0x0000000000D0A000-memory.dmpFilesize
3.3MB
-
memory/2164-63-0x00000000009C0000-0x0000000000D0A000-memory.dmpFilesize
3.3MB
-
memory/2164-66-0x00000000009C0000-0x0000000000D0A000-memory.dmpFilesize
3.3MB
-
memory/2164-65-0x00000000009C0000-0x0000000000D0A000-memory.dmpFilesize
3.3MB
-
memory/2164-69-0x00000000009C0000-0x0000000000D0A000-memory.dmpFilesize
3.3MB
-
memory/2164-68-0x00000000009C0000-0x0000000000D0A000-memory.dmpFilesize
3.3MB
-
memory/2164-67-0x00000000009C0000-0x0000000000D0A000-memory.dmpFilesize
3.3MB
-
memory/2164-70-0x00000000009C0000-0x0000000000D0A000-memory.dmpFilesize
3.3MB
-
memory/2164-72-0x00000000009C0000-0x0000000000D0A000-memory.dmpFilesize
3.3MB
-
memory/2164-73-0x0000000010000000-0x000000001006A000-memory.dmpFilesize
424KB
-
memory/2164-82-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2164-81-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/2164-95-0x000000007EFDB000-0x000000007EFDE000-memory.dmpFilesize
12KB
-
memory/2164-83-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2164-84-0x0000000000280000-0x00000000002C0000-memory.dmpFilesize
256KB
-
memory/2164-88-0x0000000000670000-0x00000000009B5000-memory.dmpFilesize
3.3MB
-
memory/2164-94-0x0000000010000000-0x000000001006A000-memory.dmpFilesize
424KB
-
memory/2164-121-0x0000000076C80000-0x0000000076D90000-memory.dmpFilesize
1.1MB
-
memory/2164-57-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2164-78-0x0000000010000000-0x000000001006A000-memory.dmpFilesize
424KB
-
memory/2164-98-0x0000000010000000-0x000000001006A000-memory.dmpFilesize
424KB
-
memory/2164-99-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2164-104-0x0000000076C80000-0x0000000076D90000-memory.dmpFilesize
1.1MB
-
memory/2164-103-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2164-105-0x0000000002F80000-0x0000000003080000-memory.dmpFilesize
1024KB
-
memory/2164-106-0x0000000003230000-0x0000000003240000-memory.dmpFilesize
64KB
-
memory/2164-107-0x0000000003410000-0x0000000003510000-memory.dmpFilesize
1024KB
-
memory/2164-108-0x0000000002CD0000-0x0000000002CE0000-memory.dmpFilesize
64KB
-
memory/2164-109-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2164-111-0x0000000003190000-0x00000000031A0000-memory.dmpFilesize
64KB
-
memory/2164-110-0x0000000003510000-0x0000000003610000-memory.dmpFilesize
1024KB
-
memory/2164-112-0x0000000010000000-0x000000001006A000-memory.dmpFilesize
424KB
-
memory/2164-113-0x00000000009C0000-0x0000000000D0A000-memory.dmpFilesize
3.3MB
-
memory/2164-114-0x00000000777A0000-0x00000000777A1000-memory.dmpFilesize
4KB
-
memory/2164-115-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2164-116-0x0000000076C80000-0x0000000076D90000-memory.dmpFilesize
1.1MB
-
memory/2164-56-0x00000000777A0000-0x00000000777A1000-memory.dmpFilesize
4KB
-
memory/2164-119-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2164-97-0x000000007EFDF000-0x000000007EFE0000-memory.dmpFilesize
4KB
-
memory/2164-122-0x00000000009C0000-0x0000000000D0A000-memory.dmpFilesize
3.3MB