azorult | f260826b576ab6e2de24d288956fc3e268d113e10b7c19b7c7ee7ba51f82fe43 | Triage™

Analysis

max time kernel
46s
max time network
112s
platform
windows10_x64
resource
win10v20201028
submitted
01/12/2020, 20:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Trojan.PackedNET.405.4960.10359.exe
Size 720KB
Sample201201-6smf5exbqa
SHA256 f260826b576ab6e2de24d288956fc3e268d113e10b7c19b7c7ee7ba51f82fe43
MD5 cc3ec298ba38176dac27966b4b5d8cbf
SHA1 fa5a028fe268c21563e5c831d2091c4ff5637674
SHA512 4002d8526d4763cdc2f08a2b97173ed546c1bd9f2e43716520230d5313a991759113b1c64422f42a265a3957cb286afea64a8ce934d5084468ced79a84cee599
MD5 SHA1 SHA512

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://52.58.209.130/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 988 set thread context of 192	988	SecuriteInfo.com.Trojan.PackedNET.405.4960.10359.exe	78

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 988 wrote to memory of 192	988	SecuriteInfo.com.Trojan.PackedNET.405.4960.10359.exe	78
PID 988 wrote to memory of 192	988	SecuriteInfo.com.Trojan.PackedNET.405.4960.10359.exe	78
PID 988 wrote to memory of 192	988	SecuriteInfo.com.Trojan.PackedNET.405.4960.10359.exe	78
PID 988 wrote to memory of 192	988	SecuriteInfo.com.Trojan.PackedNET.405.4960.10359.exe	78
PID 988 wrote to memory of 192	988	SecuriteInfo.com.Trojan.PackedNET.405.4960.10359.exe	78
PID 988 wrote to memory of 192	988	SecuriteInfo.com.Trojan.PackedNET.405.4960.10359.exe	78
PID 988 wrote to memory of 192	988	SecuriteInfo.com.Trojan.PackedNET.405.4960.10359.exe	78
PID 988 wrote to memory of 192	988	SecuriteInfo.com.Trojan.PackedNET.405.4960.10359.exe	78
PID 988 wrote to memory of 192	988	SecuriteInfo.com.Trojan.PackedNET.405.4960.10359.exe	78

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.405.4960.10359.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.405.4960.10359.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:988
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.405.4960.10359.exe
  "{path}"
  2⤵
  PID:192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/192-2-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/192-4-0x0000000000400000-0x0000000000420000-memory.dmp

Download