azorult | 980ba1a8bbabaea3660d93c50b0467c22e1934ca026eeed63339c2d36f888294

Analysis

Target

980ba1a8bbabaea3660d93c50b0467c22e1934ca026eeed63339c2d36f888294.exe
Size

628KB
MD5

5a8f760f3528fc3c94baec387cd05f7a
SHA1

d65b195f4b83dd025e1605cbc51fcb2f07b27f74
SHA256

980ba1a8bbabaea3660d93c50b0467c22e1934ca026eeed63339c2d36f888294
SHA512

871fa63b645feaacb075a5c065b380c58d815a85a4e259e168eb19a46bc2cfd37726283472196dd7d6b5073d127f3427d9084cf1328758d1760af6f91d8d0b98

Score

10^/10

Family

azorult

http://165.22.238.171/index.php

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3908	980ba1a8bbabaea3660d93c50b0467c22e1934ca026eeed63339c2d36f888294.exe
3908	980ba1a8bbabaea3660d93c50b0467c22e1934ca026eeed63339c2d36f888294.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 3428	3908	980ba1a8bbabaea3660d93c50b0467c22e1934ca026eeed63339c2d36f888294.exe	67
PID 3908 wrote to memory of 3428	3908	980ba1a8bbabaea3660d93c50b0467c22e1934ca026eeed63339c2d36f888294.exe	67
PID 3908 wrote to memory of 3428	3908	980ba1a8bbabaea3660d93c50b0467c22e1934ca026eeed63339c2d36f888294.exe	67

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3908	980ba1a8bbabaea3660d93c50b0467c22e1934ca026eeed63339c2d36f888294.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3908 set thread context of 3428	3908	980ba1a8bbabaea3660d93c50b0467c22e1934ca026eeed63339c2d36f888294.exe	67

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

C:\Users\Admin\AppData\Local\Temp\980ba1a8bbabaea3660d93c50b0467c22e1934ca026eeed63339c2d36f888294.exe
"C:\Users\Admin\AppData\Local\Temp\980ba1a8bbabaea3660d93c50b0467c22e1934ca026eeed63339c2d36f888294.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:3908
- C:\Users\Admin\AppData\Local\Temp\980ba1a8bbabaea3660d93c50b0467c22e1934ca026eeed63339c2d36f888294.exe
  "C:\Users\Admin\AppData\Local\Temp\980ba1a8bbabaea3660d93c50b0467c22e1934ca026eeed63339c2d36f888294.exe"
  2⤵
  PID:3428

memory/3428-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3428-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download