azorult | 1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd

Analysis

Target

1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe
Size

623KB
MD5

c547dc9b16fab08be2031db5d1d4b115
SHA1

8dd7522d227d1a7e65dbdff56ec3b0ec622645fe
SHA256

1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd
SHA512

71648b7ec372a364262b26c8d1532eadccbf7d00ac2fe58ce303a59d401e762222d529ddb923311537356c3212c393159b6cfe57bf81930864e2cfaf30060c74

Score

10^/10

Family

azorult

http://165.22.238.171/index.php

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1144 set thread context of 840	1144	1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe	24

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1144	1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 840	1144	1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe	24
PID 1144 wrote to memory of 840	1144	1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe	24
PID 1144 wrote to memory of 840	1144	1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe	24
PID 1144 wrote to memory of 840	1144	1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe	24

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1144	1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe

C:\Users\Admin\AppData\Local\Temp\1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe
"C:\Users\Admin\AppData\Local\Temp\1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
PID:1144
- C:\Users\Admin\AppData\Local\Temp\1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe
  "C:\Users\Admin\AppData\Local\Temp\1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe"
  2⤵
  PID:840

memory/840-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/840-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download