azorult | 1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd | Triage

Analysis

max time kernel
53s
max time network
66s
platform
windows7_x64
resource
win7
submitted
07-07-2020 17:24

Sharing

Report Analysis Logs

General

Target

Data Sheet.exe
Size

623KB
MD5

c547dc9b16fab08be2031db5d1d4b115
SHA1

8dd7522d227d1a7e65dbdff56ec3b0ec622645fe
SHA256

1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd
SHA512

71648b7ec372a364262b26c8d1532eadccbf7d00ac2fe58ce303a59d401e762222d529ddb923311537356c3212c393159b6cfe57bf81930864e2cfaf30060c74

Score

10^/10

trojan infostealer azorult

Malware Config

Extracted

Family

azorult

C2

http://165.22.238.171/index.php

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

Data Sheet.exe

description pid process target process

PID 1100 set thread context of 1256 1100 Data Sheet.exe Data Sheet.exe
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Data Sheet.exe

pid process

1100 Data Sheet.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Data Sheet.exe

description	pid	process	target process
PID 1100 wrote to memory of 1256	1100	Data Sheet.exe	Data Sheet.exe
PID 1100 wrote to memory of 1256	1100	Data Sheet.exe	Data Sheet.exe
PID 1100 wrote to memory of 1256	1100	Data Sheet.exe	Data Sheet.exe
PID 1100 wrote to memory of 1256	1100	Data Sheet.exe	Data Sheet.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

Data Sheet.exe

pid process

1100 Data Sheet.exe

C:\Users\Admin\AppData\Local\Temp\Data Sheet.exe
"C:\Users\Admin\AppData\Local\Temp\Data Sheet.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
PID:1100

C:\Users\Admin\AppData\Local\Temp\Data Sheet.exe
"C:\Users\Admin\AppData\Local\Temp\Data Sheet.exe"
2⤵
PID:1256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1256-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1256-1-0x000000000041A1F8-mapping.dmp

Download
memory/1256-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download