azorult | a35f9e69ee2c9d0b04c25a12381ff80af0853556f4091925cf72bef2a6039878

General

Target

DHL Shipment Docs & BL.exe
Size

884KB
MD5

966492e21bd34905a2cb7a48c3a62da4
SHA1

293e6ee45e7606eb6b46169a383f011dc348f1cd
SHA256

a35f9e69ee2c9d0b04c25a12381ff80af0853556f4091925cf72bef2a6039878
SHA512

4c48aa4ced3eeb461362fc7d7b67ef31951191c2e45517af7141253bda352675b29b37bcdfb2d61f0d8c40e4362164646c87fcdb11b82bb6095ce68f4ce43b77

Score

10^/10

Family

azorult

C2

http://185.222.58.102/don/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

DHL Shipment Docs & BL.exe

description pid process target process

PID 4760 set thread context of 856 4760 DHL Shipment Docs & BL.exe DHL Shipment Docs & BL.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

DHL Shipment Docs & BL.exe

description pid process

Token: SeDebugPrivilege 4760 DHL Shipment Docs & BL.exe

description	pid	process	target process
PID 4760 set thread context of 856	4760	DHL Shipment Docs & BL.exe	DHL Shipment Docs & BL.exe

description	pid	process
Token: SeDebugPrivilege	4760	DHL Shipment Docs & BL.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

DHL Shipment Docs & BL.exe

description	pid	process	target process
PID 4760 wrote to memory of 856	4760	DHL Shipment Docs & BL.exe	DHL Shipment Docs & BL.exe
PID 4760 wrote to memory of 856	4760	DHL Shipment Docs & BL.exe	DHL Shipment Docs & BL.exe
PID 4760 wrote to memory of 856	4760	DHL Shipment Docs & BL.exe	DHL Shipment Docs & BL.exe
PID 4760 wrote to memory of 856	4760	DHL Shipment Docs & BL.exe	DHL Shipment Docs & BL.exe
PID 4760 wrote to memory of 856	4760	DHL Shipment Docs & BL.exe	DHL Shipment Docs & BL.exe
PID 4760 wrote to memory of 856	4760	DHL Shipment Docs & BL.exe	DHL Shipment Docs & BL.exe
PID 4760 wrote to memory of 856	4760	DHL Shipment Docs & BL.exe	DHL Shipment Docs & BL.exe
PID 4760 wrote to memory of 856	4760	DHL Shipment Docs & BL.exe	DHL Shipment Docs & BL.exe
PID 4760 wrote to memory of 856	4760	DHL Shipment Docs & BL.exe	DHL Shipment Docs & BL.exe

C:\Users\Admin\AppData\Local\Temp\DHL Shipment Docs & BL.exe
"C:\Users\Admin\AppData\Local\Temp\DHL Shipment Docs & BL.exe"
2⤵
PID:856

memory/856-13-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/856-15-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/856-14-0x000000000041A684-mapping.dmp

Download
memory/4760-7-0x0000000007550000-0x0000000007551000-memory.dmp

Filesize
4KB

Download
memory/4760-5-0x00000000051F0000-0x00000000051F1000-memory.dmp

Filesize
4KB

Download
memory/4760-6-0x0000000007480000-0x00000000074C1000-memory.dmp

Filesize
260KB

Download
memory/4760-0-0x00000000732D0000-0x00000000739BE000-memory.dmp

Filesize
6.9MB

Download
memory/4760-10-0x00000000074D0000-0x00000000074D1000-memory.dmp

Filesize
4KB

Download
memory/4760-11-0x0000000007740000-0x0000000007741000-memory.dmp

Filesize
4KB

Download
memory/4760-12-0x0000000007720000-0x0000000007736000-memory.dmp

Filesize
88KB

Download
memory/4760-4-0x0000000005250000-0x0000000005251000-memory.dmp

Filesize
4KB

Download
memory/4760-3-0x00000000056B0000-0x00000000056B1000-memory.dmp

Filesize
4KB

Download
memory/4760-1-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download