Analysis
- max time kernel
142s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
04/01/2024, 11:45
General
- Target 40c69c72bb95c7370a0e75e299370b77.exe
- Size 408KB
- Sample240104-nwry4shdf9
- SHA256 aae9e232abe6255663d52d2db42079a395e3e50f712b8a39f269116ed419f8c6
Malware Config
Extracted
-
azorult
-
http://37.0.8.80/index.php
Signatures
- Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\40c69c72bb95c7370a0e75e299370b77.exe"C:\Users\Admin\AppData\Local\Temp\40c69c72bb95c7370a0e75e299370b77.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\40c69c72bb95c7370a0e75e299370b77.exe"{path}"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1800-12-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1800-19-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1800-18-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1800-16-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1800-15-0x0000000000400000-0x0000000000420000-memory.dmp
memory/3908-4-0x0000000004EF0000-0x0000000004F00000-memory.dmp
memory/3908-6-0x0000000004EC0000-0x0000000004EC8000-memory.dmp
memory/3908-7-0x0000000005F80000-0x000000000601C000-memory.dmp
memory/3908-8-0x0000000074F90000-0x0000000075740000-memory.dmp
memory/3908-9-0x0000000004EF0000-0x0000000004F00000-memory.dmp
memory/3908-10-0x00000000065F0000-0x0000000006666000-memory.dmp
memory/3908-11-0x00000000064C0000-0x00000000064E6000-memory.dmp
memory/3908-5-0x0000000004E20000-0x0000000004E2A000-memory.dmp
memory/3908-0-0x0000000000300000-0x000000000036C000-memory.dmp
memory/3908-3-0x0000000004D80000-0x0000000004E12000-memory.dmp
memory/3908-17-0x0000000074F90000-0x0000000075740000-memory.dmp
memory/3908-2-0x0000000005330000-0x00000000058D4000-memory.dmp
memory/3908-1-0x0000000074F90000-0x0000000075740000-memory.dmp