Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2024 13:32
Static task
static1
Behavioral task
behavioral1
Sample
Product Order List.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Product Order List.exe
Resource
win10v2004-20240226-en
General
-
Target
Product Order List.exe
-
Size
650KB
-
MD5
ed0036978d1f0d13c67c94edc283e131
-
SHA1
5176e4a336fce9a98fb19d3fcb43c3510dc85f64
-
SHA256
a18751ed6b5abd2fa637e0d4aa4eb794ee98b00e631c0fd2a4f92e9aeeca53e5
-
SHA512
26724f913b8e51fd883ba74f298429fa17ac367c02d6437f271eca670f3243fc4a86713fc80a2c759bb43366390bd32bc6fb3485baebb7ece36d4a7edf37a88c
-
SSDEEP
12288:VV0WtzPtYaer5hxPY3bvl/ZeUEjZZaJ8SsBdYaer:VV0WVMr5TYLFUa8SsSr
Malware Config
Extracted
azorult
http://193.247.144.166/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Product Order List.exedescription pid process target process PID 3240 set thread context of 2940 3240 Product Order List.exe Product Order List.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Product Order List.exedescription pid process target process PID 3240 wrote to memory of 2940 3240 Product Order List.exe Product Order List.exe PID 3240 wrote to memory of 2940 3240 Product Order List.exe Product Order List.exe PID 3240 wrote to memory of 2940 3240 Product Order List.exe Product Order List.exe PID 3240 wrote to memory of 2940 3240 Product Order List.exe Product Order List.exe PID 3240 wrote to memory of 2940 3240 Product Order List.exe Product Order List.exe PID 3240 wrote to memory of 2940 3240 Product Order List.exe Product Order List.exe PID 3240 wrote to memory of 2940 3240 Product Order List.exe Product Order List.exe PID 3240 wrote to memory of 2940 3240 Product Order List.exe Product Order List.exe PID 3240 wrote to memory of 2940 3240 Product Order List.exe Product Order List.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Product Order List.exe"C:\Users\Admin\AppData\Local\Temp\Product Order List.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Product Order List.exe"{path}"2⤵
-
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exeC:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2940-17-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2940-24-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2940-23-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2940-20-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2940-19-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3240-1-0x0000000074D60000-0x0000000075311000-memory.dmpFilesize
5.7MB
-
memory/3240-2-0x0000000001780000-0x0000000001790000-memory.dmpFilesize
64KB
-
memory/3240-0-0x0000000074D60000-0x0000000075311000-memory.dmpFilesize
5.7MB
-
memory/3240-22-0x0000000074D60000-0x0000000075311000-memory.dmpFilesize
5.7MB
-
memory/3240-16-0x0000000001780000-0x0000000001790000-memory.dmpFilesize
64KB
-
memory/3240-10-0x0000000001780000-0x0000000001790000-memory.dmpFilesize
64KB
-
memory/3240-11-0x0000000074D60000-0x0000000075311000-memory.dmpFilesize
5.7MB
-
memory/3240-12-0x0000000001780000-0x0000000001790000-memory.dmpFilesize
64KB
-
memory/4100-5-0x00000000013A0000-0x00000000013B0000-memory.dmpFilesize
64KB
-
memory/4100-14-0x00000000013A0000-0x00000000013B0000-memory.dmpFilesize
64KB
-
memory/4100-15-0x00000000013A0000-0x00000000013B0000-memory.dmpFilesize
64KB
-
memory/4100-13-0x00007FFE594B0000-0x00007FFE59E51000-memory.dmpFilesize
9.6MB
-
memory/4100-9-0x00000000013A0000-0x00000000013B0000-memory.dmpFilesize
64KB
-
memory/4100-8-0x000000001B080000-0x000000001B1B6000-memory.dmpFilesize
1.2MB
-
memory/4100-7-0x000000001A970000-0x000000001AD44000-memory.dmpFilesize
3.8MB
-
memory/4100-6-0x00007FFE594B0000-0x00007FFE59E51000-memory.dmpFilesize
9.6MB
-
memory/4100-4-0x00007FFE594B0000-0x00007FFE59E51000-memory.dmpFilesize
9.6MB
-
memory/4100-3-0x0000000001540000-0x0000000001560000-memory.dmpFilesize
128KB