azorult | acc926769da08ae780c7b3a04742b447f3b0a0a0b40806665419c9826cc2de6b

Analysis

Target

setup.exe
Size

330KB
MD5

4fb12915ec3df629bd6debb020c9335a
SHA1

74f392b9d1292f9b8f785aab1195da3af4b3ce05
SHA256

acc926769da08ae780c7b3a04742b447f3b0a0a0b40806665419c9826cc2de6b
SHA512

d2b7106f1ec8fb5575056c61846921ce8fe963cb652c7f451c95f5798b96463b5a88fb2d9591d32e0a54fedf0ddd85acd4d41a7110df3d70970674dbee900981

Score

10^/10

Family

azorult

http://195.245.112.115/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

setup.exe

description pid process target process

PID 3084 set thread context of 2724 3084 setup.exe setup.exe

description	pid	process	target process
PID 3084 set thread context of 2724	3084	setup.exe	setup.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

setup.exe

description	pid	process	target process
PID 3084 wrote to memory of 2724	3084	setup.exe	setup.exe
PID 3084 wrote to memory of 2724	3084	setup.exe	setup.exe
PID 3084 wrote to memory of 2724	3084	setup.exe	setup.exe
PID 3084 wrote to memory of 2724	3084	setup.exe	setup.exe
PID 3084 wrote to memory of 2724	3084	setup.exe	setup.exe
PID 3084 wrote to memory of 2724	3084	setup.exe	setup.exe
PID 3084 wrote to memory of 2724	3084	setup.exe	setup.exe
PID 3084 wrote to memory of 2724	3084	setup.exe	setup.exe
PID 3084 wrote to memory of 2724	3084	setup.exe	setup.exe
PID 3084 wrote to memory of 2724	3084	setup.exe	setup.exe

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
2⤵
PID:2724

memory/2724-3-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2724-4-0x000000000041A684-mapping.dmp

Download
memory/2724-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3084-2-0x0000000006180000-0x0000000006181000-memory.dmp

Filesize
4KB

Download
memory/3084-6-0x0000000004A60000-0x0000000004A7E000-memory.dmp

Filesize
120KB

Download
memory/3084-5-0x00000000001D0000-0x00000000001E1000-memory.dmp

Filesize
68KB

Download