azorult | 980ba1a8bbabaea3660d93c50b0467c22e1934ca026eeed63339c2d36f888294 | Triage

Analysis

max time kernel
123s
max time network
124s
platform
windows10_x64
resource
win10
submitted
16/07/2020, 18:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

company profile.exe
Size

628KB
MD5

5a8f760f3528fc3c94baec387cd05f7a
SHA1

d65b195f4b83dd025e1605cbc51fcb2f07b27f74
SHA256

980ba1a8bbabaea3660d93c50b0467c22e1934ca026eeed63339c2d36f888294
SHA512

871fa63b645feaacb075a5c065b380c58d815a85a4e259e168eb19a46bc2cfd37726283472196dd7d6b5073d127f3427d9084cf1328758d1760af6f91d8d0b98

Score

10^/10

trojan infostealer azorult

Malware Config

Extracted

Family

azorult

C2

http://165.22.238.171/index.php

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
720	company profile.exe
720	company profile.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 720 wrote to memory of 3840	720	company profile.exe	67
PID 720 wrote to memory of 3840	720	company profile.exe	67
PID 720 wrote to memory of 3840	720	company profile.exe	67

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
720	company profile.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 720 set thread context of 3840	720	company profile.exe	67

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

C:\Users\Admin\AppData\Local\Temp\company profile.exe
"C:\Users\Admin\AppData\Local\Temp\company profile.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:720
- C:\Users\Admin\AppData\Local\Temp\company profile.exe
  "C:\Users\Admin\AppData\Local\Temp\company profile.exe"
  2⤵
  PID:3840

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3840-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3840-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download