azorult | a424b30d1dacb4ef13395109de5b43d2f8253942b2d521d5f6f78a129de4ce77

Analysis

Target
New order.exe
Size 500KB
Sample200703-2ay97p3htx
SHA256 a424b30d1dacb4ef13395109de5b43d2f8253942b2d521d5f6f78a129de4ce77
MD5 4c4cdf53382fa24c1892eac66c7e4724
SHA1 cf22a1eaf17e0addf54b8dee33920bda95daeced
SHA512 b41343c8f5052aff72e31df5384d33f47bae57a7c6d0fb409e11c00f65e6e51eaeca66d0773c33d8a9df1a873ee9bb85c06bc125a32f6515ee73085b8a9efdac
MD5 SHA1 SHA512

Score

10^/10

Family

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Executes dropped EXE 1 IoCs

pid	Process
1680	AddInProcess32.exe

Loads dropped DLL 1 IoCs

pid	Process
240	New order.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 240 set thread context of 1680	240	New order.exe	24

Suspicious behavior: EnumeratesProcesses 3 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	240	New order.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 240 wrote to memory of 1680	240	New order.exe	24
PID 240 wrote to memory of 1680	240	New order.exe	24
PID 240 wrote to memory of 1680	240	New order.exe	24
PID 240 wrote to memory of 1680	240	New order.exe	24
PID 240 wrote to memory of 1680	240	New order.exe	24
PID 240 wrote to memory of 1680	240	New order.exe	24
PID 240 wrote to memory of 1680	240	New order.exe	24
PID 240 wrote to memory of 1680	240	New order.exe	24
PID 240 wrote to memory of 1680	240	New order.exe	24
PID 240 wrote to memory of 1680	240	New order.exe	24

C:\Users\Admin\AppData\Local\Temp\New order.exe
"C:\Users\Admin\AppData\Local\Temp\New order.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:240
- C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
  "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
  2⤵
  - Executes dropped EXE
  PID:1680

memory/1680-4-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1680-7-0x0000000000400000-0x0000000000420000-memory.dmp

Download