Analysis

  • max time kernel
    122s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    04-03-2024 20:42

General

  • Target

    1296-72-0x0000000000400000-0x0000000000422000-memory.exe

  • Size

    136KB

  • MD5

    f7e4591e9b5d24e9b2024b6c218f0c7f

  • SHA1

    5582a3722a714cc9ee57e9c46a62731910d01874

  • SHA256

    7529ef8411e4bf746c734e3dd43ca2e75457a3a36e80b2fba6dda03fd18e1251

  • SHA512

    c774b3b7fef1972180ed50fa34422fd1a00c5bc1e9ee24deb1970fd15421dc964c09aff1a4a8029f0a4caacdbff23231187f87c2fd1002a7ad10971fe981f07d

  • SSDEEP

    3072:hExRaQ6raoCoCyz6/mqv1JR+yBtGOeaeWgiRqgM:yaO1tme++wigH

Malware Config

Extracted

Family

azorult

C2

http://bll5e.shop/dbkl/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1296-72-0x0000000000400000-0x0000000000422000-memory.exe
    "C:\Users\Admin\AppData\Local\Temp\1296-72-0x0000000000400000-0x0000000000422000-memory.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1940
    • C:\Users\Admin\AppData\Local\Temp\FB_4125.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\FB_4125.tmp.exe"
      2⤵
      • Executes dropped EXE
      PID:2752
    • C:\Users\Admin\AppData\Local\Temp\FB_41C2.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\FB_41C2.tmp.exe"
      2⤵
      • Executes dropped EXE
      PID:2524

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\FB_4125.tmp.exe
    Filesize

    3KB

    MD5

    74bafb3e707c7b0c63938ac200f99c7f

    SHA1

    10c5506337845ed9bf25c73d2506f9c15ab8e608

    SHA256

    129450ba06ad589cf6846a455a5b6b5f55e164ee4906e409eb692ab465269689

    SHA512

    5b24dc5acd14f812658e832b587b60695fb16954fca006c2c3a7382ef0ec65c3bd1aaf699425c49ff3cceef16869e75dd6f00ec189b9f673f08f7e1b80cf7781

  • \Users\Admin\AppData\Local\Temp\FB_41C2.tmp.exe
    Filesize

    112KB

    MD5

    2dd2c9bac5fb8aaad15d3b6b86ca5579

    SHA1

    4a4c8c3f3b625ef05f52c5169e6f20c2c0f7821d

    SHA256

    6d7ada69aa8260a1c9d4108a03258468bd050603be333e4f8b2f85c79de0338c

    SHA512

    8b5a936fecb66b7d1fa5e12b9a2cd3145d0fec8e56dc66dfdd8ed6b306c036028c2f74b228bb5b284a5886c19093e0ba12486f3374f5e917e19ee56510d865f7

  • memory/2524-18-0x0000000000400000-0x0000000000420000-memory.dmp
    Filesize

    128KB