azorult | aee6577ef4a0d538fecd2596cedc2cdcd8eed86e9267c1bb40b0a17fbb5e51a3

Analysis

max time kernel
71s
max time network
71s
platform
windows7_x64
resource
win7v20201028
submitted
09/11/2020, 20:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tYSxU8ntb4EH6UM.exe
Size 300KB
Sample201109-tvanar61vx
SHA256 aee6577ef4a0d538fecd2596cedc2cdcd8eed86e9267c1bb40b0a17fbb5e51a3
MD5 96509397c6364372ff29e7aef7eab529
SHA1 e99fa86e9444177bc178dab416638fc1450d0a12
SHA512 dc3afbe0ff92e0c887be3b9ca8cd900efeec7394e36397cc50e1636be4dac4b9c85abeb63d9138a98e27de50ceee78f5d7bcdc15ae772ab519d66d58050cd14a
MD5 SHA1 SHA512

Score

10^/10

azorult infostealer rezer0 trojan

Malware Config

Extracted

Family

azorult

http://duhailcs.ga/nenye/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

rezer0 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

resource	yara_rule
behavioral1/memory/1744-4-0x0000000000770000-0x0000000000794000-memory.dmp	rezer0

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1744 set thread context of 1276	1744	tYSxU8ntb4EH6UM.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1744	tYSxU8ntb4EH6UM.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1744	tYSxU8ntb4EH6UM.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 1284	1744	tYSxU8ntb4EH6UM.exe	26
PID 1744 wrote to memory of 1284	1744	tYSxU8ntb4EH6UM.exe	26
PID 1744 wrote to memory of 1284	1744	tYSxU8ntb4EH6UM.exe	26
PID 1744 wrote to memory of 1284	1744	tYSxU8ntb4EH6UM.exe	26
PID 1744 wrote to memory of 1276	1744	tYSxU8ntb4EH6UM.exe	27
PID 1744 wrote to memory of 1276	1744	tYSxU8ntb4EH6UM.exe	27
PID 1744 wrote to memory of 1276	1744	tYSxU8ntb4EH6UM.exe	27
PID 1744 wrote to memory of 1276	1744	tYSxU8ntb4EH6UM.exe	27
PID 1744 wrote to memory of 1276	1744	tYSxU8ntb4EH6UM.exe	27
PID 1744 wrote to memory of 1276	1744	tYSxU8ntb4EH6UM.exe	27
PID 1744 wrote to memory of 1276	1744	tYSxU8ntb4EH6UM.exe	27
PID 1744 wrote to memory of 1276	1744	tYSxU8ntb4EH6UM.exe	27
PID 1744 wrote to memory of 1276	1744	tYSxU8ntb4EH6UM.exe	27
PID 1744 wrote to memory of 1276	1744	tYSxU8ntb4EH6UM.exe	27

C:\Users\Admin\AppData\Local\Temp\tYSxU8ntb4EH6UM.exe
"C:\Users\Admin\AppData\Local\Temp\tYSxU8ntb4EH6UM.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Users\Admin\AppData\Local\Temp\tYSxU8ntb4EH6UM.exe
  "C:\Users\Admin\AppData\Local\Temp\tYSxU8ntb4EH6UM.exe"
  2⤵
  PID:1284
- C:\Users\Admin\AppData\Local\Temp\tYSxU8ntb4EH6UM.exe
  "C:\Users\Admin\AppData\Local\Temp\tYSxU8ntb4EH6UM.exe"
  2⤵
  PID:1276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1276-5-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1276-7-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/1744-0-0x0000000073F40000-0x000000007462E000-memory.dmp

Download

memory/1744-1-0x0000000000820000-0x0000000000821000-memory.dmp

Download

memory/1744-3-0x00000000003F0000-0x00000000003F4000-memory.dmp

Download

memory/1744-4-0x0000000000770000-0x0000000000794000-memory.dmp

Download

memory/1980-8-0x000007FEF5BD0000-0x000007FEF5E4A000-memory.dmp

Download