Overview
overview
10Static
static
3Densus.exe
windows7-x64
10Densus.exe
windows10-2004-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3megapode.app
macos-10.15-amd64
1Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22-01-2024 10:45
Static task
static1
Behavioral task
behavioral1
Sample
Densus.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Densus.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
megapode.app
Resource
macos-20231201-en
General
-
Target
Densus.exe
-
Size
407KB
-
MD5
df0c6018e50894692e02b8858386ac25
-
SHA1
d843d1c5eb74ae26978aaf9ad0cc99ec2cfbcca4
-
SHA256
fae283e4b242564d01fa9dd0f3014c9742c2529730c988c3774a136e6941f6da
-
SHA512
03c7b3ea49388bedccf6abc750697b8a4498278c0e19b86317dfb52c0dffb92e1c24431d0860b7d99d777d6845e77689efb7fb44001f6fda001dd571ed0a37e5
-
SSDEEP
6144:54t6Lsvq5WSBHdzKYFZHibnx2tTt6VNETAhuog6cjmSlJe:5kvqcSBHZKYXCbn8eXh3pcCoJ
Malware Config
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Loads dropped DLL 4 IoCs
Processes:
Densus.exepid process 3180 Densus.exe 3180 Densus.exe 3180 Densus.exe 3180 Densus.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
Densus.exepid process 1636 Densus.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
Densus.exeDensus.exepid process 3180 Densus.exe 1636 Densus.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Densus.exedescription pid process target process PID 3180 set thread context of 1636 3180 Densus.exe Densus.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Densus.exepid process 3180 Densus.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
Densus.exedescription pid process target process PID 3180 wrote to memory of 1636 3180 Densus.exe Densus.exe PID 3180 wrote to memory of 1636 3180 Densus.exe Densus.exe PID 3180 wrote to memory of 1636 3180 Densus.exe Densus.exe PID 3180 wrote to memory of 1636 3180 Densus.exe Densus.exe PID 3180 wrote to memory of 1636 3180 Densus.exe Densus.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Densus.exe"C:\Users\Admin\AppData\Local\Temp\Densus.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\Densus.exe"C:\Users\Admin\AppData\Local\Temp\Densus.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1636
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD517ed1c86bd67e78ade4712be48a7d2bd
SHA11cc9fe86d6d6030b4dae45ecddce5907991c01a0
SHA256bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
SHA5120cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
-
Filesize
9KB
MD542b064366f780c1f298fa3cb3aeae260
SHA15b0349db73c43f35227b252b9aa6555f5ede9015
SHA256c13104552b8b553159f50f6e2ca45114493397a6fa4bf2cbb960c4a2bbd349ab
SHA51250d8f4f7a3ff45d5854741e7c4153fa13ee1093bafbe9c2adc60712ed2fb505c9688dd420d75aaea1b696da46b6beccc232e41388bc2a16b1f9eea1832df1cd7
-
Filesize
6KB
MD5b55f7f1b17c39018910c23108f929082
SHA11601f1cc0d0d6bcf35799b7cd15550cd01556172
SHA256c4c6fe032f3cd8b31528d7b99661f85ee22cb78746aee98ec568431d4f5043f7
SHA512d652f2b09396ef7b9181996c4700b25840ceaa6c1c10080a55ce3db4c25d8d85f00a21e747f9d14a3374be4cdd4ea829a18d7de9b27b13b5e304447f3e9268fa