Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-03-2024 13:32
Static task
static1
Behavioral task
behavioral1
Sample
Product Order List.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Product Order List.exe
Resource
win10v2004-20240226-en
General
-
Target
Product Order List.exe
-
Size
650KB
-
MD5
ed0036978d1f0d13c67c94edc283e131
-
SHA1
5176e4a336fce9a98fb19d3fcb43c3510dc85f64
-
SHA256
a18751ed6b5abd2fa637e0d4aa4eb794ee98b00e631c0fd2a4f92e9aeeca53e5
-
SHA512
26724f913b8e51fd883ba74f298429fa17ac367c02d6437f271eca670f3243fc4a86713fc80a2c759bb43366390bd32bc6fb3485baebb7ece36d4a7edf37a88c
-
SSDEEP
12288:VV0WtzPtYaer5hxPY3bvl/ZeUEjZZaJ8SsBdYaer:VV0WVMr5TYLFUa8SsSr
Malware Config
Extracted
azorult
http://193.247.144.166/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Product Order List.exedescription pid process target process PID 2180 set thread context of 2264 2180 Product Order List.exe Product Order List.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Product Order List.exedescription pid process target process PID 2180 wrote to memory of 2264 2180 Product Order List.exe Product Order List.exe PID 2180 wrote to memory of 2264 2180 Product Order List.exe Product Order List.exe PID 2180 wrote to memory of 2264 2180 Product Order List.exe Product Order List.exe PID 2180 wrote to memory of 2264 2180 Product Order List.exe Product Order List.exe PID 2180 wrote to memory of 2264 2180 Product Order List.exe Product Order List.exe PID 2180 wrote to memory of 2264 2180 Product Order List.exe Product Order List.exe PID 2180 wrote to memory of 2264 2180 Product Order List.exe Product Order List.exe PID 2180 wrote to memory of 2264 2180 Product Order List.exe Product Order List.exe PID 2180 wrote to memory of 2264 2180 Product Order List.exe Product Order List.exe PID 2180 wrote to memory of 2264 2180 Product Order List.exe Product Order List.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2180-0-0x0000000074010000-0x00000000745BB000-memory.dmpFilesize
5.7MB
-
memory/2180-1-0x0000000074010000-0x00000000745BB000-memory.dmpFilesize
5.7MB
-
memory/2180-2-0x0000000000540000-0x0000000000580000-memory.dmpFilesize
256KB
-
memory/2180-3-0x0000000074010000-0x00000000745BB000-memory.dmpFilesize
5.7MB
-
memory/2180-4-0x0000000000540000-0x0000000000580000-memory.dmpFilesize
256KB
-
memory/2180-18-0x0000000074010000-0x00000000745BB000-memory.dmpFilesize
5.7MB
-
memory/2264-7-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2264-8-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2264-10-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2264-12-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2264-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2264-16-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2264-5-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2264-19-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB