Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
07-03-2024 23:11
General
-
Target
a9c8ae35d012a04266e31d26bfbf42cce383ba516146e181d5ac8d8957be71de.exe
-
Size
5.0MB
-
MD5
2945861a5c63dc8c370c2a871c0c068d
-
SHA1
bd65f9b62ac12d0fe7247da40e2e8cc8d961ea82
-
SHA256
a9c8ae35d012a04266e31d26bfbf42cce383ba516146e181d5ac8d8957be71de
-
SHA512
d6f9a43a763ee2a7be278c3e78499a397c2138fa2a029ba2d79e28fcd8098011625c9e1ffb921b98aaca96685cf888a3b910d50cc7e1aefe82011855c46b1afa
-
SSDEEP
98304:Ulcuil93rmV8VRpI4hIbl1xdeH7HxLj02pckA0nUe:wxij889UbHxkDxLj02pckp
Malware Config
Extracted
azorult
http://51.75.24.146/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Detects executables packed with Enigma 23 IoCs
-
Detects packed executables observed in Molerats 23 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9c8ae35d012a04266e31d26bfbf42cce383ba516146e181d5ac8d8957be71de.exe"C:\Users\Admin\AppData\Local\Temp\a9c8ae35d012a04266e31d26bfbf42cce383ba516146e181d5ac8d8957be71de.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
379B
MD573102579f0cc3777bdd0ba96bab8d6f4
SHA108512e731aed9cdfeebf2e8fdc24a35ea23e3477
SHA25603c937a5aba7fd7eab8ae959606ea4598e474da06b7ec63701255e7325a9e435
SHA512e3928e509d852ae8f62b6378f984013345ddff9f5073e77323703acf20ca44bebff1753f09e7343cd948559bcafe766edce38e767efc5e7e7a5fd42c37be2e13
-
Filesize
1024B
MD559544b3b6e3b094d61db637696500785
SHA1032f018879f7f0cee15270d31fc2ec85e5e070ea
SHA25614271bfdfd99fc5860a941e7d4b36660e1adad88c38115b3c2b2069cfcf07d87
SHA512aa0f3d56fc2eab6753211614971e882de0bdd097011fe08f76ff0edd9edb02b559b04580f2b109c5cc9b5cc63286dc18c642b709f83dcde6055e1fa077f49636
-
Filesize
16B
MD5ec3d19e8e9b05d025cb56c2a98ead8e7
SHA1748532edeb86496c8efe5e2327501d89ec1f13df
SHA256edb7be3ef6098a1e24d0c72bbc6f968dea773951a0dd07b63bad6d9009ae3bf4
SHA512175fb8432472b6795bb5db0eba61bc7b57331720825df5b048f3086815ba844df4f7e83e42ff9e8fe5ab01700675a774cb916677953d6e0088ffbf1fa2775349
-
Filesize
4.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4.5MB
-
Filesize
4.5MB
-
Filesize
4.5MB
-
Filesize
4.5MB
-
Filesize
4.5MB
-
Filesize
4.5MB
-
Filesize
4.5MB
-
Filesize
4.5MB
-
Filesize
4.5MB
-
Filesize
612KB
-
Filesize
612KB
-
Filesize
612KB
-
Filesize
612KB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
8KB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
612KB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
4.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
4.5MB
-
Filesize
4.1MB