azorult | e5a815ee2d9857e6b8477c44baef139dd1b0457fd0d7b1293c357eddc3d90c81

Analysis

Target

e5a815ee2d9857e6b8477c44baef139dd1b0457fd0d7b1293c357eddc3d90c81.exe
Size

693KB
MD5

161e0b9b80e449fd4b0497cde4167c42
SHA1

78a9a6b69af7e273c4c436d80596a7fcc075f3ef
SHA256

e5a815ee2d9857e6b8477c44baef139dd1b0457fd0d7b1293c357eddc3d90c81
SHA512

0cc7848d199478cbf85031f8d80e5ab680fcf99e1c002eaff96fcb6b0d6330d941d8937a7d8b5ce0f20e250a07f6cd41c1bb9f939c583b9fdce8fe6d9f2b6ead

Score

10^/10

Family

azorult

http://165.22.238.167/index.php

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3536	e5a815ee2d9857e6b8477c44baef139dd1b0457fd0d7b1293c357eddc3d90c81.exe
3536	e5a815ee2d9857e6b8477c44baef139dd1b0457fd0d7b1293c357eddc3d90c81.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 3800	3536	e5a815ee2d9857e6b8477c44baef139dd1b0457fd0d7b1293c357eddc3d90c81.exe	67
PID 3536 wrote to memory of 3800	3536	e5a815ee2d9857e6b8477c44baef139dd1b0457fd0d7b1293c357eddc3d90c81.exe	67
PID 3536 wrote to memory of 3800	3536	e5a815ee2d9857e6b8477c44baef139dd1b0457fd0d7b1293c357eddc3d90c81.exe	67

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3536	e5a815ee2d9857e6b8477c44baef139dd1b0457fd0d7b1293c357eddc3d90c81.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3536 set thread context of 3800	3536	e5a815ee2d9857e6b8477c44baef139dd1b0457fd0d7b1293c357eddc3d90c81.exe	67

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

C:\Users\Admin\AppData\Local\Temp\e5a815ee2d9857e6b8477c44baef139dd1b0457fd0d7b1293c357eddc3d90c81.exe
"C:\Users\Admin\AppData\Local\Temp\e5a815ee2d9857e6b8477c44baef139dd1b0457fd0d7b1293c357eddc3d90c81.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:3536
- C:\Users\Admin\AppData\Local\Temp\e5a815ee2d9857e6b8477c44baef139dd1b0457fd0d7b1293c357eddc3d90c81.exe
  "C:\Users\Admin\AppData\Local\Temp\e5a815ee2d9857e6b8477c44baef139dd1b0457fd0d7b1293c357eddc3d90c81.exe"
  2⤵
  PID:3800

memory/3800-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3800-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download