azorult | 6702194e907abb44e098053a29ddb3eebe2d9f0649857df43c3d265f9eb69f2f | Triage™

Analysis

max time kernel
48s
max time network
120s
platform
windows10_x64
resource
win10v20201028
submitted
02/12/2020, 04:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Trojan.DownLoader36.22329.22483.2249.exe
Size 741KB
Sample201202-aypa3dn8de
SHA256 6702194e907abb44e098053a29ddb3eebe2d9f0649857df43c3d265f9eb69f2f
MD5 fad893eedfeba43fc054f30cf002d8ba
SHA1 8be50609d4e4830e83be9bfcb4617cdeb7699ee3
SHA512 05dabd49c4fa33c7378bc1e3622923da69e9ff4297cda37578ebe3473858a373ec3cd927db2d65508c5eb9dd1d4c95b28be761ff38e9443a4b06cfe12ac79e27
MD5 SHA1 SHA512

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://15.236.142.224/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 508 set thread context of 4076	508	SecuriteInfo.com.Trojan.DownLoader36.22329.22483.2249.exe	78

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 508 wrote to memory of 4076	508	SecuriteInfo.com.Trojan.DownLoader36.22329.22483.2249.exe	78
PID 508 wrote to memory of 4076	508	SecuriteInfo.com.Trojan.DownLoader36.22329.22483.2249.exe	78
PID 508 wrote to memory of 4076	508	SecuriteInfo.com.Trojan.DownLoader36.22329.22483.2249.exe	78
PID 508 wrote to memory of 4076	508	SecuriteInfo.com.Trojan.DownLoader36.22329.22483.2249.exe	78
PID 508 wrote to memory of 4076	508	SecuriteInfo.com.Trojan.DownLoader36.22329.22483.2249.exe	78
PID 508 wrote to memory of 4076	508	SecuriteInfo.com.Trojan.DownLoader36.22329.22483.2249.exe	78
PID 508 wrote to memory of 4076	508	SecuriteInfo.com.Trojan.DownLoader36.22329.22483.2249.exe	78
PID 508 wrote to memory of 4076	508	SecuriteInfo.com.Trojan.DownLoader36.22329.22483.2249.exe	78
PID 508 wrote to memory of 4076	508	SecuriteInfo.com.Trojan.DownLoader36.22329.22483.2249.exe	78

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader36.22329.22483.2249.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader36.22329.22483.2249.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:508
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader36.22329.22483.2249.exe
  "{path}"
  2⤵
  PID:4076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4076-2-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4076-4-0x0000000000400000-0x0000000000420000-memory.dmp

Download