Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12-01-2025 22:26
General
-
Target
244ed13df3dffff2e0aa1219e0955db3.exe
-
Size
1.1MB
-
MD5
244ed13df3dffff2e0aa1219e0955db3
-
SHA1
6d6c5f116bf05bb2f1132ca4f54995c5ed09594d
-
SHA256
54bfc5ecc75601485a8ba49c299ff12016666ed53475c85fcddb82babeee2719
-
SHA512
6c3533ac2badcde267807223027dff489aafcc2c615a1f66be0fa9ffb0f710d963f31488864e1c5e15004af1988f32717b8de584511ed61fb9411f7124eec583
-
SSDEEP
24576:MAHnh+eWsN3skA4RV1Hom2KXMmHa0cH6Ww/aRf+j56:rh+ZkldoPK8Ya0226
Score
10/10
Malware Config
Extracted
Family
azorult
C2
http://parcelinn.com/wp-content/images/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Azorult family
-
Drops startup file 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\244ed13df3dffff2e0aa1219e0955db3.exe"C:\Users\Admin\AppData\Local\Temp\244ed13df3dffff2e0aa1219e0955db3.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\244ed13df3dffff2e0aa1219e0955db3.exe"C:\Users\Admin\AppData\Local\Temp\244ed13df3dffff2e0aa1219e0955db3.exe"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
128KB