Analysis
- max time kernel
147s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
07/03/2024, 23:11
General
- Target a9c8ae35d012a04266e31d26bfbf42cce383ba516146e181d5ac8d8957be71de.exe
- Size 5.0MB
- Sample240307-26ptdsgg63
- SHA256 a9c8ae35d012a04266e31d26bfbf42cce383ba516146e181d5ac8d8957be71de
Malware Config
Extracted
-
azorult
-
http://51.75.24.146/index.php
Signatures
- Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
- Detects executables packed with Enigma 23 IoCs
- Detects packed executables observed in Molerats 23 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9c8ae35d012a04266e31d26bfbf42cce383ba516146e181d5ac8d8957be71de.exe"C:\Users\Admin\AppData\Local\Temp\a9c8ae35d012a04266e31d26bfbf42cce383ba516146e181d5ac8d8957be71de.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
333355.exe_0x83175340d49e5e191208873df2f62453.1.manifest
4344_00400000_tls.dll
xsandbox.bin
memory/4344-1-0x0000000001030000-0x00000000014B5000-memory.dmp
memory/4344-6-0x0000000077D83000-0x0000000077D84000-memory.dmp
memory/4344-7-0x0000000077D82000-0x0000000077D83000-memory.dmp
memory/4344-8-0x00000000001F0000-0x00000000001F1000-memory.dmp
memory/4344-9-0x0000000001030000-0x00000000014B5000-memory.dmp
memory/4344-10-0x0000000001030000-0x00000000014B5000-memory.dmp
memory/4344-11-0x0000000001030000-0x00000000014B5000-memory.dmp
memory/4344-12-0x0000000001030000-0x00000000014B5000-memory.dmp
memory/4344-13-0x0000000001030000-0x00000000014B5000-memory.dmp
memory/4344-14-0x0000000001030000-0x00000000014B5000-memory.dmp
memory/4344-15-0x0000000001030000-0x00000000014B5000-memory.dmp
memory/4344-16-0x0000000001030000-0x00000000014B5000-memory.dmp
memory/4344-18-0x0000000001030000-0x00000000014B5000-memory.dmp
memory/4344-19-0x0000000010000000-0x0000000010099000-memory.dmp
memory/4344-24-0x0000000010000000-0x0000000010099000-memory.dmp
memory/4344-25-0x0000000010000000-0x0000000010099000-memory.dmp
memory/4344-26-0x0000000010000000-0x0000000010099000-memory.dmp
memory/4344-27-0x0000000000400000-0x000000000080D000-memory.dmp
memory/4344-38-0x0000000000400000-0x000000000080D000-memory.dmp
memory/4344-49-0x0000000000400000-0x000000000080D000-memory.dmp
memory/4344-50-0x0000000075420000-0x0000000075422000-memory.dmp
memory/4344-52-0x0000000000400000-0x000000000080D000-memory.dmp
memory/4344-54-0x0000000000400000-0x000000000080D000-memory.dmp
memory/4344-56-0x0000000000400000-0x000000000080D000-memory.dmp
memory/4344-58-0x0000000000400000-0x000000000080D000-memory.dmp
memory/4344-60-0x0000000000400000-0x000000000080D000-memory.dmp
memory/4344-62-0x0000000010000000-0x0000000010099000-memory.dmp
memory/4344-63-0x0000000000400000-0x000000000080D000-memory.dmp
memory/4344-65-0x0000000000400000-0x000000000080D000-memory.dmp
memory/4344-67-0x0000000000400000-0x000000000080D000-memory.dmp
memory/4344-69-0x0000000000400000-0x000000000080D000-memory.dmp
memory/4344-71-0x0000000000400000-0x000000000080D000-memory.dmp
memory/4344-73-0x0000000000400000-0x000000000080D000-memory.dmp
memory/4344-75-0x0000000000400000-0x000000000080D000-memory.dmp
memory/4344-77-0x0000000000400000-0x000000000080D000-memory.dmp
memory/4344-79-0x0000000000400000-0x000000000080D000-memory.dmp
memory/4344-81-0x0000000000400000-0x000000000080D000-memory.dmp
memory/4344-98-0x0000000000400000-0x000000000080D000-memory.dmp
memory/4344-100-0x0000000000400000-0x000000000080D000-memory.dmp
memory/4344-104-0x0000000001030000-0x00000000014B5000-memory.dmp
memory/4344-106-0x0000000077D82000-0x0000000077D83000-memory.dmp
memory/4344-105-0x0000000077D83000-0x0000000077D84000-memory.dmp
memory/4344-107-0x00000000001F0000-0x00000000001F1000-memory.dmp
memory/4344-108-0x0000000000400000-0x000000000080D000-memory.dmp
memory/4344-109-0x0000000000400000-0x000000000080D000-memory.dmp
memory/4344-117-0x0000000001030000-0x00000000014B5000-memory.dmp
memory/4344-118-0x0000000000400000-0x000000000080D000-memory.dmp