Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
26-01-2024 19:27
General
-
Target
SecuriteInfo.com.Win32.PWSX-gen.17580.exe
-
Size
1.2MB
-
MD5
3c870efbe2e2350a62697a545d491a30
-
SHA1
5719ab24c8b5f26d7443d7eb7580c0661002697c
-
SHA256
3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a
-
SHA512
7caf7662234055b01e91b5b045b579214f037c0ecf5265ee1425019f4795b7a808dc2a7502e9ef3950702b7815a5dd4b44403d9e86549673e0271bbe57f46e49
-
SSDEEP
24576:zfsGRdrEAbm4zusGRdrEAbm4zbL3AfemsGRdrEAbm4zNYZg4pLw:DbdYAm4zubdYAm4z/3AXbdYAm4zNYZ1w
Score
10/10
Malware Config
Extracted
Family
azorult
C2
https://5desconcertais.sa.com/cn/nem/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.17580.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.17580.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.17580.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.17580.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
148KB
-
Filesize
148KB
-
Filesize
148KB
-
Filesize
4KB
-
Filesize
148KB
-
Filesize
128KB
-
Filesize
1.5MB