Analysis
-
max time kernel
134s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-11-2024 11:39
General
-
Target
Dekont#400577_89008_96634.exe
-
Size
641KB
-
MD5
1d14f171fd8a6a070150c81abed8b966
-
SHA1
605071e065fd88525285c736dcc5f8461a60195c
-
SHA256
ffb9748a0ed7684161780e27a733f2ab11071515cc27905767813a32c8c308ff
-
SHA512
a337e284c26b730b72859c509decbc7d8733efd2729ae5d280558a504c6837e2546eb037edfad7b0f00c0b1c1cdd8e42728fc5e33dbb9f2a01315cbc47ab5182
-
SSDEEP
12288:cT02SzNhc9bP9qhlkT+8dLb1c09/p6X9uruAK5Gi:cTbSzNy9bP9Elo1O0Fp6NBAWGi
Malware Config
Extracted
azorult
http://89.40.31.232/12/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Azorult family
-
Loads dropped DLL 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dekont#400577_89008_96634.exe"C:\Users\Admin\AppData\Local\Temp\Dekont#400577_89008_96634.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Dekont#400577_89008_96634.exe"C:\Users\Admin\AppData\Local\Temp\Dekont#400577_89008_96634.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5564bb0373067e1785cba7e4c24aab4bf
SHA17c9416a01d821b10b2eef97b80899d24014d6fc1
SHA2567a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
SHA51222c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
156KB
-
Filesize
18.3MB
-
Filesize
1.1MB
-
Filesize
18.3MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB