azorult | ee0f914953c77d22365c0ae6a02e93eb5bfc55c5bee13149aa50a2acb2a2095d

Analysis

Target

ee0f914953c77d22365c0ae6a02e93eb5bfc55c5bee13149aa50a2acb2a2095d.exe
Size

628KB
MD5

bbdfb6d1d013efc03180b118e14f0900
SHA1

89c77fd82f89a15890c8eb9e2bffa6953eb9866a
SHA256

ee0f914953c77d22365c0ae6a02e93eb5bfc55c5bee13149aa50a2acb2a2095d
SHA512

b092ab1fc08c8ec40cbd97d3030b13c927ef1e0c20de59892829382b602e09a2ba5d42567dd09b12a646d02c9dcf32ed361368b6501411f34889db9bcf4f374e

Score

10^/10

Family

azorult

http://165.22.238.167/index.php

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1296	ee0f914953c77d22365c0ae6a02e93eb5bfc55c5bee13149aa50a2acb2a2095d.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 600	1296	ee0f914953c77d22365c0ae6a02e93eb5bfc55c5bee13149aa50a2acb2a2095d.exe	24
PID 1296 wrote to memory of 600	1296	ee0f914953c77d22365c0ae6a02e93eb5bfc55c5bee13149aa50a2acb2a2095d.exe	24
PID 1296 wrote to memory of 600	1296	ee0f914953c77d22365c0ae6a02e93eb5bfc55c5bee13149aa50a2acb2a2095d.exe	24
PID 1296 wrote to memory of 600	1296	ee0f914953c77d22365c0ae6a02e93eb5bfc55c5bee13149aa50a2acb2a2095d.exe	24

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1296	ee0f914953c77d22365c0ae6a02e93eb5bfc55c5bee13149aa50a2acb2a2095d.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1296 set thread context of 600	1296	ee0f914953c77d22365c0ae6a02e93eb5bfc55c5bee13149aa50a2acb2a2095d.exe	24

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

C:\Users\Admin\AppData\Local\Temp\ee0f914953c77d22365c0ae6a02e93eb5bfc55c5bee13149aa50a2acb2a2095d.exe
"C:\Users\Admin\AppData\Local\Temp\ee0f914953c77d22365c0ae6a02e93eb5bfc55c5bee13149aa50a2acb2a2095d.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:1296
- C:\Users\Admin\AppData\Local\Temp\ee0f914953c77d22365c0ae6a02e93eb5bfc55c5bee13149aa50a2acb2a2095d.exe
  "C:\Users\Admin\AppData\Local\Temp\ee0f914953c77d22365c0ae6a02e93eb5bfc55c5bee13149aa50a2acb2a2095d.exe"
  2⤵
  PID:600

memory/600-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/600-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download