azorult | 27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609

General

Target

27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe
Size

779KB
MD5

7c853c98eb2e158d2453a4318a4d4ebc
SHA1

c80b146c2e1adfc4cef469f8af5bb182c124c6fa
SHA256

27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609
SHA512

33cefb1400fcc37f2574e4b5d8f0732c1660c366bcfb5498fc2f464c5095b4cbb20096ff6a29e42597a5beec7c6e05d9bfb909eee57c16eea898ec71686a759f

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://45.144.225.131/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe

description	pid	process	target process
PID 780 set thread context of 408	780	27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe	27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe

description	pid	process	target process
PID 780 wrote to memory of 408	780	27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe	27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe
PID 780 wrote to memory of 408	780	27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe	27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe
PID 780 wrote to memory of 408	780	27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe	27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe
PID 780 wrote to memory of 408	780	27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe	27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe
PID 780 wrote to memory of 408	780	27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe	27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe
PID 780 wrote to memory of 408	780	27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe	27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe
PID 780 wrote to memory of 408	780	27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe	27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe
PID 780 wrote to memory of 408	780	27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe	27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe
PID 780 wrote to memory of 408	780	27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe	27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe

C:\Users\Admin\AppData\Local\Temp\27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe
"C:\Users\Admin\AppData\Local\Temp\27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:780

C:\Users\Admin\AppData\Local\Temp\27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609.exe
"{path}"
2⤵
PID:408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/408-115-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/408-116-0x000000000041A1F8-mapping.dmp

Download
memory/408-117-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/780-114-0x0000000002A70000-0x0000000002A71000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing