Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
15-01-2024 15:43
Static task
static1
Behavioral task
behavioral1
Sample
5d78cc5649e5ab055ee0ceb0c0141ee8.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5d78cc5649e5ab055ee0ceb0c0141ee8.exe
Resource
win10v2004-20231222-en
General
-
Target
5d78cc5649e5ab055ee0ceb0c0141ee8.exe
-
Size
511KB
-
MD5
5d78cc5649e5ab055ee0ceb0c0141ee8
-
SHA1
1c086c2f10eee7b42383515b6bf275a91396cae5
-
SHA256
d5002f26062c1ff41a841546a4c59f2a09c7982958fe3cbd38f44ea0f88127a6
-
SHA512
71ebe6e3826e261cbec7e99a8c3caf823351c25a75d0368747d2e7152028648f47c9ba30f61c9ee1ce85c831682b72a373879dc7e5f6fba5f838991593f838c3
-
SSDEEP
12288:Rr6JOCAX4pu3m/qvCoH2BbbUs+Y9H4ZIcunsLauVPRdPt:Bm1AuGm/qvCPBMs+Y
Malware Config
Extracted
azorult
http://212.192.246.242/rut/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
5d78cc5649e5ab055ee0ceb0c0141ee8.exedescription pid process target process PID 3428 set thread context of 4168 3428 5d78cc5649e5ab055ee0ceb0c0141ee8.exe 5d78cc5649e5ab055ee0ceb0c0141ee8.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
5d78cc5649e5ab055ee0ceb0c0141ee8.exepid process 3428 5d78cc5649e5ab055ee0ceb0c0141ee8.exe 3428 5d78cc5649e5ab055ee0ceb0c0141ee8.exe 3428 5d78cc5649e5ab055ee0ceb0c0141ee8.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
5d78cc5649e5ab055ee0ceb0c0141ee8.exesvchost.exedescription pid process Token: SeDebugPrivilege 3428 5d78cc5649e5ab055ee0ceb0c0141ee8.exe Token: SeManageVolumePrivilege 1948 svchost.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
5d78cc5649e5ab055ee0ceb0c0141ee8.exedescription pid process target process PID 3428 wrote to memory of 4168 3428 5d78cc5649e5ab055ee0ceb0c0141ee8.exe 5d78cc5649e5ab055ee0ceb0c0141ee8.exe PID 3428 wrote to memory of 4168 3428 5d78cc5649e5ab055ee0ceb0c0141ee8.exe 5d78cc5649e5ab055ee0ceb0c0141ee8.exe PID 3428 wrote to memory of 4168 3428 5d78cc5649e5ab055ee0ceb0c0141ee8.exe 5d78cc5649e5ab055ee0ceb0c0141ee8.exe PID 3428 wrote to memory of 4168 3428 5d78cc5649e5ab055ee0ceb0c0141ee8.exe 5d78cc5649e5ab055ee0ceb0c0141ee8.exe PID 3428 wrote to memory of 4168 3428 5d78cc5649e5ab055ee0ceb0c0141ee8.exe 5d78cc5649e5ab055ee0ceb0c0141ee8.exe PID 3428 wrote to memory of 4168 3428 5d78cc5649e5ab055ee0ceb0c0141ee8.exe 5d78cc5649e5ab055ee0ceb0c0141ee8.exe PID 3428 wrote to memory of 4168 3428 5d78cc5649e5ab055ee0ceb0c0141ee8.exe 5d78cc5649e5ab055ee0ceb0c0141ee8.exe PID 3428 wrote to memory of 4168 3428 5d78cc5649e5ab055ee0ceb0c0141ee8.exe 5d78cc5649e5ab055ee0ceb0c0141ee8.exe PID 3428 wrote to memory of 4168 3428 5d78cc5649e5ab055ee0ceb0c0141ee8.exe 5d78cc5649e5ab055ee0ceb0c0141ee8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d78cc5649e5ab055ee0ceb0c0141ee8.exe"C:\Users\Admin\AppData\Local\Temp\5d78cc5649e5ab055ee0ceb0c0141ee8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\5d78cc5649e5ab055ee0ceb0c0141ee8.exe"C:\Users\Admin\AppData\Local\Temp\5d78cc5649e5ab055ee0ceb0c0141ee8.exe"2⤵PID:4168
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:1608
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1948