azorult | 27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609 | Triage

Analysis

max time kernel
142s
max time network
141s
platform
windows10_x64
resource
win10v20210408
submitted
22-04-2021 00:40

Sharing

Report Analysis Logs

General

Target

13111.exe
Size

779KB
MD5

7c853c98eb2e158d2453a4318a4d4ebc
SHA1

c80b146c2e1adfc4cef469f8af5bb182c124c6fa
SHA256

27100674f982f5d66b447b7fb08b3a2c90c9ab393943aa187fc481d88c75b609
SHA512

33cefb1400fcc37f2574e4b5d8f0732c1660c366bcfb5498fc2f464c5095b4cbb20096ff6a29e42597a5beec7c6e05d9bfb909eee57c16eea898ec71686a759f

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://45.144.225.131/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

13111.exe

description pid process target process

PID 808 set thread context of 2300 808 13111.exe 13111.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

13111.exe

description	pid	process	target process
PID 808 wrote to memory of 2300	808	13111.exe	13111.exe
PID 808 wrote to memory of 2300	808	13111.exe	13111.exe
PID 808 wrote to memory of 2300	808	13111.exe	13111.exe
PID 808 wrote to memory of 2300	808	13111.exe	13111.exe
PID 808 wrote to memory of 2300	808	13111.exe	13111.exe
PID 808 wrote to memory of 2300	808	13111.exe	13111.exe
PID 808 wrote to memory of 2300	808	13111.exe	13111.exe
PID 808 wrote to memory of 2300	808	13111.exe	13111.exe
PID 808 wrote to memory of 2300	808	13111.exe	13111.exe

C:\Users\Admin\AppData\Local\Temp\13111.exe
"C:\Users\Admin\AppData\Local\Temp\13111.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:808

C:\Users\Admin\AppData\Local\Temp\13111.exe
"{path}"
2⤵
PID:2300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/808-114-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Filesize
4KB

Download
memory/2300-115-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2300-116-0x000000000041A1F8-mapping.dmp

Download
memory/2300-117-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download