Analysis
-
max time kernel
80s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
27-01-2024 22:46
General
-
Target
7b7c13961dd5633dbd63837ba08aaed7.exe
-
Size
720KB
-
MD5
7b7c13961dd5633dbd63837ba08aaed7
-
SHA1
e6c7f08a005b4f195cf1f0ac024442157dc0e8c0
-
SHA256
22a117c101443073379635cf75a22acfaa3dcc65c29bde65a3287d177147f2e1
-
SHA512
0875f202878e0a9a79adf5ea97f310b1b50b562c1bfcd0644164847b32369833df4f1228b9d7c9fb431fa0d9b7915374f2d8c952ca04aa1eaf0ee34ad30b39b5
-
SSDEEP
12288:XrMBoA6sOVrlU3LcedGUGnTsbArC9Vo93uFsIWRiseXubEst98B4p7UWr4:XrMrcedrSTs8m9VVWRisEs78B4pjr4
Score
10/10
Malware Config
Extracted
Family
azorult
C2
http://cwownola.org/AqwE/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Suspicious use of SetThreadContext 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b7c13961dd5633dbd63837ba08aaed7.exe"C:\Users\Admin\AppData\Local\Temp\7b7c13961dd5633dbd63837ba08aaed7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7b7c13961dd5633dbd63837ba08aaed7.exe"C:\Users\Admin\AppData\Local\Temp\7b7c13961dd5633dbd63837ba08aaed7.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 18003⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1740 -ip 17401⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
8KB