Analysis
- max time kernel
103s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20250314-en - resource tags
- submitted
16/03/2025, 02:20
General
- Target 4f39173e3003531c1cd75641b55ccbca.exe
- Size 90KB
- Sample250316-csjmsaspt2
- SHA256 5b15cd544d3b9bc4cab21814d46fb1eae2b9ec92a6865fb35fd5eb37cd9cebba
Malware Config
Extracted
-
azorult
-
http://broadwayanimalhospital.ca/wp-blog/index.php
Signatures
- Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
- Azorult family
- Suspicious use of SetThreadContext 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f39173e3003531c1cd75641b55ccbca.exe"C:\Users\Admin\AppData\Local\Temp\4f39173e3003531c1cd75641b55ccbca.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4f39173e3003531c1cd75641b55ccbca.exeC:\Users\Admin\AppData\Local\Temp\4f39173e3003531c1cd75641b55ccbca.exe2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3196-5-0x0000000000400000-0x0000000000420000-memory.dmp
memory/3196-8-0x0000000000400000-0x0000000000420000-memory.dmp
memory/3196-9-0x0000000000400000-0x0000000000420000-memory.dmp
memory/3196-11-0x0000000000400000-0x0000000000420000-memory.dmp
memory/4460-0-0x00000000748CE000-0x00000000748CF000-memory.dmp
memory/4460-1-0x0000000000B50000-0x0000000000B6C000-memory.dmp
memory/4460-2-0x0000000005BD0000-0x0000000006174000-memory.dmp
memory/4460-3-0x0000000005620000-0x00000000056BC000-memory.dmp
memory/4460-4-0x00000000748C0000-0x0000000075070000-memory.dmp
memory/4460-10-0x00000000748C0000-0x0000000075070000-memory.dmp