azorult | b0ca5198d12b8855c96897e6b3198105cf363a790bf104afa7ed6421322c07a2

General

Target

b0ca5198d12b8855c96897e6b3198105cf363a790bf104afa7ed6421322c07a2.exe
Size

808KB
MD5

4d23229aaae673afff26dc907c11541c
SHA1

a4536d34592a510279f63d6d903dc4b6ba9f9c6c
SHA256

b0ca5198d12b8855c96897e6b3198105cf363a790bf104afa7ed6421322c07a2
SHA512

dd20f835303a17350adb51d42033398962fad1a103e87c930f30ea9148be327a5f84b4cf879f9d351aa4f5ed53dae64a4168721f7baad378cf624a171c1e7033

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://31.210.20.121/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

b0ca5198d12b8855c96897e6b3198105cf363a790bf104afa7ed6421322c07a2.exe

description	pid	process	target process
PID 1016 set thread context of 3672	1016	b0ca5198d12b8855c96897e6b3198105cf363a790bf104afa7ed6421322c07a2.exe	b0ca5198d12b8855c96897e6b3198105cf363a790bf104afa7ed6421322c07a2.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

b0ca5198d12b8855c96897e6b3198105cf363a790bf104afa7ed6421322c07a2.exe

description	pid	process	target process
PID 1016 wrote to memory of 3672	1016	b0ca5198d12b8855c96897e6b3198105cf363a790bf104afa7ed6421322c07a2.exe	b0ca5198d12b8855c96897e6b3198105cf363a790bf104afa7ed6421322c07a2.exe
PID 1016 wrote to memory of 3672	1016	b0ca5198d12b8855c96897e6b3198105cf363a790bf104afa7ed6421322c07a2.exe	b0ca5198d12b8855c96897e6b3198105cf363a790bf104afa7ed6421322c07a2.exe
PID 1016 wrote to memory of 3672	1016	b0ca5198d12b8855c96897e6b3198105cf363a790bf104afa7ed6421322c07a2.exe	b0ca5198d12b8855c96897e6b3198105cf363a790bf104afa7ed6421322c07a2.exe
PID 1016 wrote to memory of 3672	1016	b0ca5198d12b8855c96897e6b3198105cf363a790bf104afa7ed6421322c07a2.exe	b0ca5198d12b8855c96897e6b3198105cf363a790bf104afa7ed6421322c07a2.exe
PID 1016 wrote to memory of 3672	1016	b0ca5198d12b8855c96897e6b3198105cf363a790bf104afa7ed6421322c07a2.exe	b0ca5198d12b8855c96897e6b3198105cf363a790bf104afa7ed6421322c07a2.exe
PID 1016 wrote to memory of 3672	1016	b0ca5198d12b8855c96897e6b3198105cf363a790bf104afa7ed6421322c07a2.exe	b0ca5198d12b8855c96897e6b3198105cf363a790bf104afa7ed6421322c07a2.exe
PID 1016 wrote to memory of 3672	1016	b0ca5198d12b8855c96897e6b3198105cf363a790bf104afa7ed6421322c07a2.exe	b0ca5198d12b8855c96897e6b3198105cf363a790bf104afa7ed6421322c07a2.exe
PID 1016 wrote to memory of 3672	1016	b0ca5198d12b8855c96897e6b3198105cf363a790bf104afa7ed6421322c07a2.exe	b0ca5198d12b8855c96897e6b3198105cf363a790bf104afa7ed6421322c07a2.exe
PID 1016 wrote to memory of 3672	1016	b0ca5198d12b8855c96897e6b3198105cf363a790bf104afa7ed6421322c07a2.exe	b0ca5198d12b8855c96897e6b3198105cf363a790bf104afa7ed6421322c07a2.exe

C:\Users\Admin\AppData\Local\Temp\b0ca5198d12b8855c96897e6b3198105cf363a790bf104afa7ed6421322c07a2.exe
"C:\Users\Admin\AppData\Local\Temp\b0ca5198d12b8855c96897e6b3198105cf363a790bf104afa7ed6421322c07a2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1016

C:\Users\Admin\AppData\Local\Temp\b0ca5198d12b8855c96897e6b3198105cf363a790bf104afa7ed6421322c07a2.exe
"{path}"
2⤵
PID:3672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1016-114-0x00000000026D0000-0x00000000026D1000-memory.dmp

Filesize
4KB

Download
memory/3672-115-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3672-116-0x000000000041A1F8-mapping.dmp

Download
memory/3672-117-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing