azorult | 59e39b6123ed1218d7ae3b4406b3e06c1fc84ecb8fafad05e762b9867c77248b

Analysis

Target

59e39b6123ed1218d7ae3b4406b3e06c1fc84ecb8fafad05e762b9867c77248b.exe
Size

610KB
MD5

f5e4f8f6a83e7648f7f2943eb6201f6b
SHA1

50e92375676bd017755bfb352565a0378d760e5b
SHA256

59e39b6123ed1218d7ae3b4406b3e06c1fc84ecb8fafad05e762b9867c77248b
SHA512

fc6dc6bd2c0415aa06a13e7a73179141b5756042c6fdf8cda0325b2b89b49bc36b81a445b7231fe913b40922e56b6124c7a7e7dd04e701fb9a3169325eaec2d0

Score

10^/10

Family

azorult

http://165.22.238.167/index.php

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3896 set thread context of 1168	3896	59e39b6123ed1218d7ae3b4406b3e06c1fc84ecb8fafad05e762b9867c77248b.exe	68

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3896	59e39b6123ed1218d7ae3b4406b3e06c1fc84ecb8fafad05e762b9867c77248b.exe
3896	59e39b6123ed1218d7ae3b4406b3e06c1fc84ecb8fafad05e762b9867c77248b.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3896 wrote to memory of 1168	3896	59e39b6123ed1218d7ae3b4406b3e06c1fc84ecb8fafad05e762b9867c77248b.exe	68
PID 3896 wrote to memory of 1168	3896	59e39b6123ed1218d7ae3b4406b3e06c1fc84ecb8fafad05e762b9867c77248b.exe	68
PID 3896 wrote to memory of 1168	3896	59e39b6123ed1218d7ae3b4406b3e06c1fc84ecb8fafad05e762b9867c77248b.exe	68

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3896	59e39b6123ed1218d7ae3b4406b3e06c1fc84ecb8fafad05e762b9867c77248b.exe

C:\Users\Admin\AppData\Local\Temp\59e39b6123ed1218d7ae3b4406b3e06c1fc84ecb8fafad05e762b9867c77248b.exe
"C:\Users\Admin\AppData\Local\Temp\59e39b6123ed1218d7ae3b4406b3e06c1fc84ecb8fafad05e762b9867c77248b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
PID:3896
- C:\Users\Admin\AppData\Local\Temp\59e39b6123ed1218d7ae3b4406b3e06c1fc84ecb8fafad05e762b9867c77248b.exe
  "C:\Users\Admin\AppData\Local\Temp\59e39b6123ed1218d7ae3b4406b3e06c1fc84ecb8fafad05e762b9867c77248b.exe"
  2⤵
  PID:1168

memory/1168-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1168-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download