azorult | 3d39fc826f6ed0115155842080406ffc82f930c5daae8ef710d3c30009fd0106

General

Target

Ziraat Bankasi Swift Mesaji.exe
Size

444KB
MD5

35c69b2c315a5b7d4fe4a2106dad3921
SHA1

5f89cd2ec7ff235c54bb079740427687b028f96d
SHA256

3d39fc826f6ed0115155842080406ffc82f930c5daae8ef710d3c30009fd0106
SHA512

b008b1f7c9e6c2f640ada66b84348d15ecae142740fc717392300b3d83f9922171104a546f3a7f9ce4427eebb81f85ac6dee6a3c3a8dd836af17a5d84d7f8f0e

Score

10^/10

Family

azorult

C2

http://itrad3r.com/24cd/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Executes dropped EXE 1 IoCs

Processes:

AddInProcess32.exe

pid process

1168 AddInProcess32.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Ziraat Bankasi Swift Mesaji.exe

description pid process target process

PID 428 set thread context of 1168 428 Ziraat Bankasi Swift Mesaji.exe AddInProcess32.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Ziraat Bankasi Swift Mesaji.exe

pid process

428 Ziraat Bankasi Swift Mesaji.exe
428 Ziraat Bankasi Swift Mesaji.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Ziraat Bankasi Swift Mesaji.exe

description pid process

Token: SeDebugPrivilege 428 Ziraat Bankasi Swift Mesaji.exe

pid	process
1168	AddInProcess32.exe

description	pid	process	target process
PID 428 set thread context of 1168	428	Ziraat Bankasi Swift Mesaji.exe	AddInProcess32.exe

pid	process
428	Ziraat Bankasi Swift Mesaji.exe
428	Ziraat Bankasi Swift Mesaji.exe

description	pid	process
Token: SeDebugPrivilege	428	Ziraat Bankasi Swift Mesaji.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Ziraat Bankasi Swift Mesaji.exe

description	pid	process	target process
PID 428 wrote to memory of 1168	428	Ziraat Bankasi Swift Mesaji.exe	AddInProcess32.exe
PID 428 wrote to memory of 1168	428	Ziraat Bankasi Swift Mesaji.exe	AddInProcess32.exe
PID 428 wrote to memory of 1168	428	Ziraat Bankasi Swift Mesaji.exe	AddInProcess32.exe
PID 428 wrote to memory of 1168	428	Ziraat Bankasi Swift Mesaji.exe	AddInProcess32.exe
PID 428 wrote to memory of 1168	428	Ziraat Bankasi Swift Mesaji.exe	AddInProcess32.exe
PID 428 wrote to memory of 1168	428	Ziraat Bankasi Swift Mesaji.exe	AddInProcess32.exe
PID 428 wrote to memory of 1168	428	Ziraat Bankasi Swift Mesaji.exe	AddInProcess32.exe
PID 428 wrote to memory of 1168	428	Ziraat Bankasi Swift Mesaji.exe	AddInProcess32.exe
PID 428 wrote to memory of 1168	428	Ziraat Bankasi Swift Mesaji.exe	AddInProcess32.exe

C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"
2⤵
- Executes dropped EXE
PID:1168

C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe
MD5
6a673bfc3b67ae9782cb31af2f234c68

SHA1
7544e89566d91e84e3cd437b9a073e5f6b56566e

SHA256
978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e

SHA512
72c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39

Download Submit
memory/428-2-0x0000000073160000-0x000000007384E000-memory.dmp

Filesize
6.9MB

Download
memory/428-3-0x0000000000900000-0x0000000000901000-memory.dmp

Filesize
4KB

Download
memory/428-5-0x0000000005320000-0x0000000005321000-memory.dmp

Filesize
4KB

Download
memory/428-6-0x0000000005210000-0x000000000522E000-memory.dmp

Filesize
120KB

Download
memory/428-7-0x0000000005280000-0x0000000005281000-memory.dmp

Filesize
4KB

Download
memory/428-8-0x0000000007C90000-0x0000000007C91000-memory.dmp

Filesize
4KB

Download
memory/428-9-0x0000000005470000-0x000000000547B000-memory.dmp

Filesize
44KB

Download
memory/428-10-0x0000000005490000-0x0000000005491000-memory.dmp

Filesize
4KB

Download
memory/1168-11-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1168-12-0x000000000041A684-mapping.dmp

Download
memory/1168-14-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download