Behavioral task
behavioral1
Sample
2476-3-0x0000000000400000-0x000000000043B000-memory.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2476-3-0x0000000000400000-0x000000000043B000-memory.exe
Resource
win10v2004-20231215-en
General
-
Target
2476-3-0x0000000000400000-0x000000000043B000-memory.dmp
-
Size
236KB
-
MD5
f61f9e75bf82d9ad07c4e8fb5027ee65
-
SHA1
6412f49d18220f751bf137605122eb913ed769a5
-
SHA256
5a2947c27c84748be5192a448518b8d05f70910ab0426c172f6b38f5b32ecadc
-
SHA512
20cfff5519faf2f460e409dd923ef7d66ce1b05314db39ab50a3f5caaa689f8d0e6fbf5eced6f83d47615bfc0477e4814734b6c1906b71f3edc8cf2e785bec19
-
SSDEEP
3072:KExRaQ6raoCoCyz6/mqv1JR+yBtGOeaeWgiIqkSm7mN/9EMxrXR7v52XNm+cmk:faO1tme++wi37mUEwUvcL
Malware Config
Extracted
azorult
http://94.156.65.101/cleanlogo/index.php
Signatures
-
Azorult family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2476-3-0x0000000000400000-0x000000000043B000-memory.dmp
Files
-
2476-3-0x0000000000400000-0x000000000043B000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 2KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ