Analysis
-
max time kernel
141s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
26-01-2024 19:27
General
-
Target
SecuriteInfo.com.Win32.PWSX-gen.17580.exe
-
Size
1.2MB
-
MD5
3c870efbe2e2350a62697a545d491a30
-
SHA1
5719ab24c8b5f26d7443d7eb7580c0661002697c
-
SHA256
3a31af96c5d5bb68be19f9eeb3dc6c3dd09d9c51292f54b51cd6db0960c8a84a
-
SHA512
7caf7662234055b01e91b5b045b579214f037c0ecf5265ee1425019f4795b7a808dc2a7502e9ef3950702b7815a5dd4b44403d9e86549673e0271bbe57f46e49
-
SSDEEP
24576:zfsGRdrEAbm4zusGRdrEAbm4zbL3AfemsGRdrEAbm4zNYZg4pLw:DbdYAm4zubdYAm4z/3AXbdYAm4zNYZ1w
Malware Config
Extracted
azorult
https://5desconcertais.sa.com/cn/nem/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Loads dropped DLL 4 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.17580.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.17580.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.17580.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.PWSX-gen.17580.exe"2⤵
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD59e682f1eb98a9d41468fc3e50f907635
SHA185e0ceca36f657ddf6547aa0744f0855a27527ee
SHA256830533bb569594ec2f7c07896b90225006b90a9af108f49d6fb6bebd02428b2d
SHA512230230722d61ac1089fabf3f2decfa04f9296498f8e2a2a49b1527797dca67b5a11ab8656f04087acadf873fa8976400d57c77c404eba4aff89d92b9986f32ed
-
Filesize
373KB
MD5d073258c9b867244f83f9f668ade0009
SHA11fc57869e3affb6fad68d032147071b3b7195a4e
SHA2565e94be0cd4ce5db8913eab1e7e0f3eacda23eaf90ac40b5e852d8aac9587894e
SHA512065c1e88a2058141761eabc90a5ec2455fa1f73dee43f56ab953740e3b8d3ff806d0dea3ad5b06792be9b1e8abf6c33491e36985a5a51badfe42aaa1804e6ff4
-
Filesize
594KB
MD5910dc41a94071cc435d607880fb66684
SHA1891669e94ee63e9cbfcd3911fedd385af109fadb
SHA2565e038cf80cdc2fc10bdb78ea7944cf1928e3ca8bd72bc442c47071613f9a716f
SHA51292efebe63cc7fda491fbba7ee7f2c685db6c4235eb4c53562b979b0f7b54c46fca53fbe57ffe4c99f844778e6ecc06056372a34da19c8f89a8fbe6c05995f14d
-
Filesize
81KB
MD57587bf9cb4147022cd5681b015183046
SHA1f2106306a8f6f0da5afb7fc765cfa0757ad5a628
SHA256c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
SHA5120b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
148KB
-
Filesize
148KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
148KB
-
Filesize
148KB
-
Filesize
128KB