Analysis
- max time kernel
148s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
27/03/2024, 13:32
General
- Target Product Order List.exe
- Size 650KB
- Sample240327-qtbkfsdb45
- SHA256 a18751ed6b5abd2fa637e0d4aa4eb794ee98b00e631c0fd2a4f92e9aeeca53e5
Malware Config
Extracted
-
azorult
-
http://193.247.144.166/index.php
Signatures
- Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Product Order List.exe"C:\Users\Admin\AppData\Local\Temp\Product Order List.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Product Order List.exe"{path}"2⤵
-
-
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exeC:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2940-17-0x0000000000400000-0x0000000000420000-memory.dmp
memory/2940-24-0x0000000000400000-0x0000000000420000-memory.dmp
memory/2940-23-0x0000000000400000-0x0000000000420000-memory.dmp
memory/2940-20-0x0000000000400000-0x0000000000420000-memory.dmp
memory/2940-19-0x0000000000400000-0x0000000000420000-memory.dmp
memory/3240-1-0x0000000074D60000-0x0000000075311000-memory.dmp
memory/3240-2-0x0000000001780000-0x0000000001790000-memory.dmp
memory/3240-0-0x0000000074D60000-0x0000000075311000-memory.dmp
memory/3240-22-0x0000000074D60000-0x0000000075311000-memory.dmp
memory/3240-16-0x0000000001780000-0x0000000001790000-memory.dmp
memory/3240-10-0x0000000001780000-0x0000000001790000-memory.dmp
memory/3240-11-0x0000000074D60000-0x0000000075311000-memory.dmp
memory/3240-12-0x0000000001780000-0x0000000001790000-memory.dmp
memory/4100-5-0x00000000013A0000-0x00000000013B0000-memory.dmp
memory/4100-14-0x00000000013A0000-0x00000000013B0000-memory.dmp
memory/4100-15-0x00000000013A0000-0x00000000013B0000-memory.dmp
memory/4100-13-0x00007FFE594B0000-0x00007FFE59E51000-memory.dmp
memory/4100-9-0x00000000013A0000-0x00000000013B0000-memory.dmp
memory/4100-8-0x000000001B080000-0x000000001B1B6000-memory.dmp
memory/4100-7-0x000000001A970000-0x000000001AD44000-memory.dmp
memory/4100-6-0x00007FFE594B0000-0x00007FFE59E51000-memory.dmp
memory/4100-4-0x00007FFE594B0000-0x00007FFE59E51000-memory.dmp
memory/4100-3-0x0000000001540000-0x0000000001560000-memory.dmp