Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
06-11-2024 15:23
Static task
static1
Behavioral task
behavioral1
Sample
f64a7307f5e75e2e73e93c5e2ed8009e8698e2c388a707afabbb756ecd0e1261.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f64a7307f5e75e2e73e93c5e2ed8009e8698e2c388a707afabbb756ecd0e1261.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
General
-
Target
f64a7307f5e75e2e73e93c5e2ed8009e8698e2c388a707afabbb756ecd0e1261.exe
-
Size
638KB
-
MD5
bf29fb1d74335d667f7a40f94f33406c
-
SHA1
3c94e2b216cfa76850b4528d05fce86c3849156d
-
SHA256
f64a7307f5e75e2e73e93c5e2ed8009e8698e2c388a707afabbb756ecd0e1261
-
SHA512
26fb49c34d1e0ef2b4f49852e3158267cd3e24de128a2045f0307b1cf92445fbbf8e9a4e7f1730af54561f15a71b94c6f4417cc06b2a1634cc2acab2fdcef416
-
SSDEEP
12288:cT02vSJpK7Z91wqowV9vc5B0vmZiNp6X9uruAK5Gi:cTbvSJsZwqow65BAhp6NBAWGi
Malware Config
Extracted
azorult
http://cq4cq.icu/PL341/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Azorult family
-
Guloader family
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Loads dropped DLL 1 IoCs
pid Process 1020 f64a7307f5e75e2e73e93c5e2ed8009e8698e2c388a707afabbb756ecd0e1261.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 2536 f64a7307f5e75e2e73e93c5e2ed8009e8698e2c388a707afabbb756ecd0e1261.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1020 f64a7307f5e75e2e73e93c5e2ed8009e8698e2c388a707afabbb756ecd0e1261.exe 2536 f64a7307f5e75e2e73e93c5e2ed8009e8698e2c388a707afabbb756ecd0e1261.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1020 set thread context of 2536 1020 f64a7307f5e75e2e73e93c5e2ed8009e8698e2c388a707afabbb756ecd0e1261.exe 91 -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\slutstrenge.tri f64a7307f5e75e2e73e93c5e2ed8009e8698e2c388a707afabbb756ecd0e1261.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\resources\0409\Semiprofessionalized248\evaluxir.pra f64a7307f5e75e2e73e93c5e2ed8009e8698e2c388a707afabbb756ecd0e1261.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f64a7307f5e75e2e73e93c5e2ed8009e8698e2c388a707afabbb756ecd0e1261.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f64a7307f5e75e2e73e93c5e2ed8009e8698e2c388a707afabbb756ecd0e1261.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1020 f64a7307f5e75e2e73e93c5e2ed8009e8698e2c388a707afabbb756ecd0e1261.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1020 wrote to memory of 2536 1020 f64a7307f5e75e2e73e93c5e2ed8009e8698e2c388a707afabbb756ecd0e1261.exe 91 PID 1020 wrote to memory of 2536 1020 f64a7307f5e75e2e73e93c5e2ed8009e8698e2c388a707afabbb756ecd0e1261.exe 91 PID 1020 wrote to memory of 2536 1020 f64a7307f5e75e2e73e93c5e2ed8009e8698e2c388a707afabbb756ecd0e1261.exe 91 PID 1020 wrote to memory of 2536 1020 f64a7307f5e75e2e73e93c5e2ed8009e8698e2c388a707afabbb756ecd0e1261.exe 91 PID 1020 wrote to memory of 2536 1020 f64a7307f5e75e2e73e93c5e2ed8009e8698e2c388a707afabbb756ecd0e1261.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\f64a7307f5e75e2e73e93c5e2ed8009e8698e2c388a707afabbb756ecd0e1261.exe"C:\Users\Admin\AppData\Local\Temp\f64a7307f5e75e2e73e93c5e2ed8009e8698e2c388a707afabbb756ecd0e1261.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\f64a7307f5e75e2e73e93c5e2ed8009e8698e2c388a707afabbb756ecd0e1261.exe"C:\Users\Admin\AppData\Local\Temp\f64a7307f5e75e2e73e93c5e2ed8009e8698e2c388a707afabbb756ecd0e1261.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:2536
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5564bb0373067e1785cba7e4c24aab4bf
SHA17c9416a01d821b10b2eef97b80899d24014d6fc1
SHA2567a9ddee34562cd3703f1502b5c70e99cd5bba15de2b6845a3555033d7f6cb2a5
SHA51222c61a323cb9293d7ec5c7e7e60674d0e2f7b29d55be25eb3c128ea2cd7440a1400cee17c43896b996278007c0d247f331a9b8964e3a40a0eb1404a9596c4472