azorult | b4ecc0c3ee4f0c96dabac652a849d748ffca834225f70da8d7bb81e234a54834 | Triage™

Analysis

max time kernel
131s
max time network
131s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 19:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.MSIL.GenKryptik.EKGR.13047.exe
Size 454KB
Sample201109-dcpp5hmg2e
SHA256 b4ecc0c3ee4f0c96dabac652a849d748ffca834225f70da8d7bb81e234a54834
MD5 6d7d5a9b177094e127bf489796605593
SHA1 f978415bde607550f37326820bafbcfc398645d1
SHA512 4aab76dc4ffab9a69c6ed57d1a8f85599d5f6e2af395fa37af0aba1381b6b8bcbdd1a1351f76d139d08258dd6c1fac217c03b27cf51c6f1b8d5a28dfb47501fa
MD5 SHA1 SHA512

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 984 set thread context of 3604	984	SecuriteInfo.com.MSIL.GenKryptik.EKGR.13047.exe	75

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 3604	984	SecuriteInfo.com.MSIL.GenKryptik.EKGR.13047.exe	75
PID 984 wrote to memory of 3604	984	SecuriteInfo.com.MSIL.GenKryptik.EKGR.13047.exe	75
PID 984 wrote to memory of 3604	984	SecuriteInfo.com.MSIL.GenKryptik.EKGR.13047.exe	75
PID 984 wrote to memory of 3604	984	SecuriteInfo.com.MSIL.GenKryptik.EKGR.13047.exe	75
PID 984 wrote to memory of 3604	984	SecuriteInfo.com.MSIL.GenKryptik.EKGR.13047.exe	75
PID 984 wrote to memory of 3604	984	SecuriteInfo.com.MSIL.GenKryptik.EKGR.13047.exe	75
PID 984 wrote to memory of 3604	984	SecuriteInfo.com.MSIL.GenKryptik.EKGR.13047.exe	75
PID 984 wrote to memory of 3604	984	SecuriteInfo.com.MSIL.GenKryptik.EKGR.13047.exe	75
PID 984 wrote to memory of 3604	984	SecuriteInfo.com.MSIL.GenKryptik.EKGR.13047.exe	75

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.GenKryptik.EKGR.13047.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.GenKryptik.EKGR.13047.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:984
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.MSIL.GenKryptik.EKGR.13047.exe
  "{path}"
  2⤵
  PID:3604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3604-0-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3604-2-0x0000000000400000-0x0000000000420000-memory.dmp

Download