Analysis
-
max time kernel
140s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
12-03-2024 04:47
Static task
static1
Behavioral task
behavioral1
Sample
51034ad4a20dec916ce9a900a667be57.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
51034ad4a20dec916ce9a900a667be57.exe
Resource
win10v2004-20240226-en
General
-
Target
51034ad4a20dec916ce9a900a667be57.exe
-
Size
420KB
-
MD5
51034ad4a20dec916ce9a900a667be57
-
SHA1
74503a74d7a2b82a4390b092e6c4b66656c6f2ea
-
SHA256
d803bbeca71dfcbc03c2e8fed4dbb5c7ccdd778c70558ca282df97dea20fc1bf
-
SHA512
89c17f7189fd25055e2fa48f0296f453ff3317d5baf799732c4d7a6f307dc77db2e8004459766ac78dafa312d3f8a6c0b9df8e32aa8a2df6e71314a9388f4e61
-
SSDEEP
6144:KSTz3MaMNhXbyuWt2EHOO+7qeA5fphPFrKz1K59uYtuwI9JXhr5464NYCmkG0PRy:3Ty7A9ugI9fFCmAPRdhe
Malware Config
Extracted
azorult
http://xcelonline.000webhostapp.com/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
51034ad4a20dec916ce9a900a667be57.exedescription pid process target process PID 3068 set thread context of 1936 3068 51034ad4a20dec916ce9a900a667be57.exe 51034ad4a20dec916ce9a900a667be57.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2548 1936 WerFault.exe 51034ad4a20dec916ce9a900a667be57.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
51034ad4a20dec916ce9a900a667be57.exepid process 3068 51034ad4a20dec916ce9a900a667be57.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
51034ad4a20dec916ce9a900a667be57.exepid process 3068 51034ad4a20dec916ce9a900a667be57.exe 3068 51034ad4a20dec916ce9a900a667be57.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
51034ad4a20dec916ce9a900a667be57.exe51034ad4a20dec916ce9a900a667be57.exedescription pid process target process PID 3068 wrote to memory of 1936 3068 51034ad4a20dec916ce9a900a667be57.exe 51034ad4a20dec916ce9a900a667be57.exe PID 3068 wrote to memory of 1936 3068 51034ad4a20dec916ce9a900a667be57.exe 51034ad4a20dec916ce9a900a667be57.exe PID 3068 wrote to memory of 1936 3068 51034ad4a20dec916ce9a900a667be57.exe 51034ad4a20dec916ce9a900a667be57.exe PID 3068 wrote to memory of 1936 3068 51034ad4a20dec916ce9a900a667be57.exe 51034ad4a20dec916ce9a900a667be57.exe PID 3068 wrote to memory of 1936 3068 51034ad4a20dec916ce9a900a667be57.exe 51034ad4a20dec916ce9a900a667be57.exe PID 3068 wrote to memory of 1936 3068 51034ad4a20dec916ce9a900a667be57.exe 51034ad4a20dec916ce9a900a667be57.exe PID 3068 wrote to memory of 1936 3068 51034ad4a20dec916ce9a900a667be57.exe 51034ad4a20dec916ce9a900a667be57.exe PID 3068 wrote to memory of 1936 3068 51034ad4a20dec916ce9a900a667be57.exe 51034ad4a20dec916ce9a900a667be57.exe PID 3068 wrote to memory of 1936 3068 51034ad4a20dec916ce9a900a667be57.exe 51034ad4a20dec916ce9a900a667be57.exe PID 3068 wrote to memory of 1936 3068 51034ad4a20dec916ce9a900a667be57.exe 51034ad4a20dec916ce9a900a667be57.exe PID 3068 wrote to memory of 1936 3068 51034ad4a20dec916ce9a900a667be57.exe 51034ad4a20dec916ce9a900a667be57.exe PID 3068 wrote to memory of 1936 3068 51034ad4a20dec916ce9a900a667be57.exe 51034ad4a20dec916ce9a900a667be57.exe PID 3068 wrote to memory of 1936 3068 51034ad4a20dec916ce9a900a667be57.exe 51034ad4a20dec916ce9a900a667be57.exe PID 3068 wrote to memory of 1936 3068 51034ad4a20dec916ce9a900a667be57.exe 51034ad4a20dec916ce9a900a667be57.exe PID 3068 wrote to memory of 1936 3068 51034ad4a20dec916ce9a900a667be57.exe 51034ad4a20dec916ce9a900a667be57.exe PID 3068 wrote to memory of 1936 3068 51034ad4a20dec916ce9a900a667be57.exe 51034ad4a20dec916ce9a900a667be57.exe PID 3068 wrote to memory of 1936 3068 51034ad4a20dec916ce9a900a667be57.exe 51034ad4a20dec916ce9a900a667be57.exe PID 1936 wrote to memory of 2548 1936 51034ad4a20dec916ce9a900a667be57.exe WerFault.exe PID 1936 wrote to memory of 2548 1936 51034ad4a20dec916ce9a900a667be57.exe WerFault.exe PID 1936 wrote to memory of 2548 1936 51034ad4a20dec916ce9a900a667be57.exe WerFault.exe PID 1936 wrote to memory of 2548 1936 51034ad4a20dec916ce9a900a667be57.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\51034ad4a20dec916ce9a900a667be57.exe"C:\Users\Admin\AppData\Local\Temp\51034ad4a20dec916ce9a900a667be57.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\51034ad4a20dec916ce9a900a667be57.exeC:\Users\Admin\AppData\Local\Temp\51034ad4a20dec916ce9a900a667be57.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 7443⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1936-0-0x0000000000300000-0x0000000000400000-memory.dmpFilesize
1024KB
-
memory/1936-1-0x0000000000400000-0x0000000001080000-memory.dmpFilesize
12.5MB
-
memory/1936-3-0x0000000000400000-0x0000000001080000-memory.dmpFilesize
12.5MB
-
memory/1936-5-0x0000000000400000-0x0000000001080000-memory.dmpFilesize
12.5MB
-
memory/1936-7-0x0000000000400000-0x0000000001080000-memory.dmpFilesize
12.5MB
-
memory/1936-9-0x0000000000400000-0x0000000001080000-memory.dmpFilesize
12.5MB
-
memory/1936-11-0x0000000000400000-0x0000000001080000-memory.dmpFilesize
12.5MB
-
memory/1936-13-0x0000000000400000-0x0000000001080000-memory.dmpFilesize
12.5MB
-
memory/1936-15-0x0000000000400000-0x0000000001080000-memory.dmpFilesize
12.5MB
-
memory/1936-17-0x0000000000400000-0x0000000001080000-memory.dmpFilesize
12.5MB
-
memory/1936-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1936-21-0x0000000000400000-0x0000000001080000-memory.dmpFilesize
12.5MB
-
memory/1936-24-0x0000000000400000-0x0000000001080000-memory.dmpFilesize
12.5MB
-
memory/1936-26-0x0000000000400000-0x0000000001080000-memory.dmpFilesize
12.5MB
-
memory/1936-27-0x0000000000400000-0x0000000001080000-memory.dmpFilesize
12.5MB
-
memory/1936-28-0x0000000000400000-0x0000000001080000-memory.dmpFilesize
12.5MB
-
memory/1936-29-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1936-31-0x0000000000400000-0x0000000001080000-memory.dmpFilesize
12.5MB