Analysis
-
max time kernel
119s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-01-2025 11:16
General
-
Target
1946b17684f64b798e304016f5b932c9c1fb87e9936891270da0cff37c23fe14N.exe
-
Size
894KB
-
MD5
5607cc3b26c24be9e3d86606766eee30
-
SHA1
851990f70494d5bae5269c1fb2697e2e3b126705
-
SHA256
1946b17684f64b798e304016f5b932c9c1fb87e9936891270da0cff37c23fe14
-
SHA512
c219833e8f4e94113c7854d988207d0649c683d208c12b115d3ee5aa9fe544ef0d1f9ec8966d8ed461a1a88eef2a0a6bc5a9aa459562fafaea9a628fe8a417cc
-
SSDEEP
12288:J9zo1yfwJLWb+nw7UodVcr49VG9aU7SY5bA9SfUq0rOp0Y4H2xk:PXb+nyUE9VG9au89Sf50rUL4H2S
Malware Config
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Azorult family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 36 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1946b17684f64b798e304016f5b932c9c1fb87e9936891270da0cff37c23fe14N.exe"C:\Users\Admin\AppData\Local\Temp\1946b17684f64b798e304016f5b932c9c1fb87e9936891270da0cff37c23fe14N.exe"1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
942KB
-
Filesize
942KB