azorult | 9dd2e2e1dc00671e8faee152525a1dd54d069cdd13da671eea3a825c1ac69864

Analysis

Target
RFQ452.exe
Size 676KB
Sample200813-lkxbbafbx2
SHA256 9dd2e2e1dc00671e8faee152525a1dd54d069cdd13da671eea3a825c1ac69864
MD5 4c6c42a1760c912ffd0398c52e7dcc16
SHA1 c49d79093cc183ac858fe0c7624cdcbae2280d93
SHA512 43131664d46487e12bb6cc3b5aa568940941ccd08dfc7cbc9ed930a689fa54fcb8c2314503d0c48cb60b5882db87fea8d26b7aa2fd1a966388b3938fb0608cf3
MD5 SHA1 SHA512

Score

10^/10

Family

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2956 set thread context of 3664	2956	RFQ452.exe	67

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2956	RFQ452.exe
2956	RFQ452.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2956	RFQ452.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 3664	2956	RFQ452.exe	67
PID 2956 wrote to memory of 3664	2956	RFQ452.exe	67
PID 2956 wrote to memory of 3664	2956	RFQ452.exe	67

C:\Users\Admin\AppData\Local\Temp\RFQ452.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ452.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Users\Admin\AppData\Local\Temp\RFQ452.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ452.exe"
  2⤵
  PID:3664

memory/3664-0-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3664-2-0x0000000000400000-0x0000000000420000-memory.dmp

Download