Behavioral task
behavioral1
Sample
944-71-0x0000000000400000-0x0000000001462000-memory.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
944-71-0x0000000000400000-0x0000000001462000-memory.exe
Resource
win10v2004-20240226-en
General
-
Target
944-71-0x0000000000400000-0x0000000001462000-memory.dmp
-
Size
16.4MB
-
MD5
70263a86eff208b84223b30858744745
-
SHA1
19c6626f7e7f5ab25d0ffcef81105a01890267b1
-
SHA256
2c4c5f32a390be27074f9af284d6db11f3e0cea0c3cfc2ef8121373299783956
-
SHA512
6c8fa2d2f5c5133b3525b5dad3e63d159758a2ba500f3425cca1222b34e19c4cc7895069f2992cb19c149c79cb305070a246ade39d83f9fef48881ec0aac446a
-
SSDEEP
3072:KExRaQ6raoCoCyz6/mqv1JR+yBtGOeaeWgieq:faO1tme++wiR
Malware Config
Extracted
azorult
http://lazo1t.shop/lazo1t/index.php
Signatures
-
Azorult family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 944-71-0x0000000000400000-0x0000000001462000-memory.dmp
Files
-
944-71-0x0000000000400000-0x0000000001462000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 2KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ