Analysis
- max time kernel
146s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
19/03/2024, 04:49
General
- Target d53c8a9351e8f882d8b79225bba17aa7.exe
- Size 1.4MB
- Sample240319-ffvfashh89
- SHA256 b4d1ee0e59a2113473a47b726eb279d4960b810dbb483507f84b6314185c6dad
Malware Config
Extracted
-
azorult
-
http://invalid666.zzz.com.ua/index.php
Signatures
- Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d53c8a9351e8f882d8b79225bba17aa7.exe"C:\Users\Admin\AppData\Local\Temp\d53c8a9351e8f882d8b79225bba17aa7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\SysWOW64\dllhost.exe"2⤵
-
-
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\SysWOW64\dllhost.exe"2⤵
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2052-2-0x0000000000400000-0x0000000000420000-memory.dmp
memory/2052-4-0x0000000000400000-0x0000000000420000-memory.dmp
memory/2052-5-0x0000000000400000-0x0000000000420000-memory.dmp
memory/2052-6-0x0000000000400000-0x0000000000420000-memory.dmp
memory/3924-0-0x0000000003A10000-0x0000000003A2D000-memory.dmp
memory/3924-1-0x0000000003A30000-0x0000000003A4C000-memory.dmp
memory/4668-7-0x0000013C87470000-0x0000013C87480000-memory.dmp
memory/4668-23-0x0000013C87570000-0x0000013C87580000-memory.dmp
memory/4668-39-0x0000013C8F8E0000-0x0000013C8F8E1000-memory.dmp
memory/4668-41-0x0000013C8F910000-0x0000013C8F911000-memory.dmp
memory/4668-42-0x0000013C8F910000-0x0000013C8F911000-memory.dmp
memory/4668-43-0x0000013C8FA20000-0x0000013C8FA21000-memory.dmp