azorult | 1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd

Analysis

Target

1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe
Size

623KB
MD5

c547dc9b16fab08be2031db5d1d4b115
SHA1

8dd7522d227d1a7e65dbdff56ec3b0ec622645fe
SHA256

1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd
SHA512

71648b7ec372a364262b26c8d1532eadccbf7d00ac2fe58ce303a59d401e762222d529ddb923311537356c3212c393159b6cfe57bf81930864e2cfaf30060c74

Score

10^/10

Family

azorult

http://165.22.238.171/index.php

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe

pid	process
724	1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe
724	1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe

description	pid	process	target process
PID 724 wrote to memory of 732	724	1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe	1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe
PID 724 wrote to memory of 732	724	1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe	1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe
PID 724 wrote to memory of 732	724	1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe	1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe

pid process

724 1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe

description	pid	process	target process
PID 724 set thread context of 732	724	1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe	1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

C:\Users\Admin\AppData\Local\Temp\1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe
"C:\Users\Admin\AppData\Local\Temp\1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd.exe"
2⤵
PID:732

memory/732-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/732-1-0x000000000041A1F8-mapping.dmp

Download
memory/732-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download