Analysis
- max time kernel
166s - max time network
174s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
12/10/2023, 16:56
General
- Target cb8a7799a825e8f8c98076a9fefadf4d.exe
- Size 544KB
- Sample231012-vfxb8aeh27
- SHA256 4c892de4082bc8e96eec96636cbc22092d2c9542eb5b322b6652e0a142c19c6d
Malware Config
Extracted
-
azorult
-
http://185.28.39.18:7777/asiamandarin.buzz/deval/index.php
Signatures
- Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb8a7799a825e8f8c98076a9fefadf4d.exe"C:\Users\Admin\AppData\Local\Temp\cb8a7799a825e8f8c98076a9fefadf4d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cb8a7799a825e8f8c98076a9fefadf4d.exe"C:\Users\Admin\AppData\Local\Temp\cb8a7799a825e8f8c98076a9fefadf4d.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1032-8-0x0000000074C60000-0x0000000075410000-memory.dmp
memory/1032-10-0x00000000057B0000-0x00000000057BA000-memory.dmp
memory/1032-2-0x00000000057F0000-0x0000000005D94000-memory.dmp
memory/1032-3-0x0000000005240000-0x00000000052D2000-memory.dmp
memory/1032-4-0x00000000053C0000-0x00000000053D0000-memory.dmp
memory/1032-5-0x0000000005300000-0x000000000530A000-memory.dmp
memory/1032-6-0x0000000005560000-0x00000000055FC000-memory.dmp
memory/1032-7-0x0000000005700000-0x0000000005718000-memory.dmp
memory/1032-1-0x00000000007F0000-0x000000000087C000-memory.dmp
memory/1032-0-0x0000000074C60000-0x0000000075410000-memory.dmp
memory/1032-9-0x00000000053C0000-0x00000000053D0000-memory.dmp
memory/1032-11-0x000000000A4A0000-0x000000000A4FC000-memory.dmp
memory/1032-17-0x0000000074C60000-0x0000000075410000-memory.dmp
memory/4364-14-0x0000000000400000-0x0000000000420000-memory.dmp
memory/4364-16-0x0000000000400000-0x0000000000420000-memory.dmp
memory/4364-12-0x0000000000400000-0x0000000000420000-memory.dmp
memory/4364-18-0x0000000000400000-0x0000000000420000-memory.dmp
memory/4364-19-0x0000000000400000-0x0000000000420000-memory.dmp