azorult | 18581044dbdf0b557aeb81598217c07c29ad2e2cd6b7dd600fe0aa64997a3803

General

Target

18581044dbdf0b557aeb81598217c07c29ad2e2cd6b7dd600fe0aa64997a3803.exe
Size

816KB
MD5

4c4b5e53036d55f9c8721344869436c0
SHA1

3376d9505bb96aa76fd18fa88c800bc4d1abcd44
SHA256

18581044dbdf0b557aeb81598217c07c29ad2e2cd6b7dd600fe0aa64997a3803
SHA512

249abcca698d94e0ee865ec6d2819e5837627678c3a083437e596eba1d44f6cc73def12e15572af17ac374e1bfe9ba6c3c36f302b54d02053f0447e7d41f0443

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://104.238.137.224/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

18581044dbdf0b557aeb81598217c07c29ad2e2cd6b7dd600fe0aa64997a3803.exe

description	pid	process	target process
PID 3876 set thread context of 3028	3876	18581044dbdf0b557aeb81598217c07c29ad2e2cd6b7dd600fe0aa64997a3803.exe	18581044dbdf0b557aeb81598217c07c29ad2e2cd6b7dd600fe0aa64997a3803.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

18581044dbdf0b557aeb81598217c07c29ad2e2cd6b7dd600fe0aa64997a3803.exe

description	pid	process	target process
PID 3876 wrote to memory of 3028	3876	18581044dbdf0b557aeb81598217c07c29ad2e2cd6b7dd600fe0aa64997a3803.exe	18581044dbdf0b557aeb81598217c07c29ad2e2cd6b7dd600fe0aa64997a3803.exe
PID 3876 wrote to memory of 3028	3876	18581044dbdf0b557aeb81598217c07c29ad2e2cd6b7dd600fe0aa64997a3803.exe	18581044dbdf0b557aeb81598217c07c29ad2e2cd6b7dd600fe0aa64997a3803.exe
PID 3876 wrote to memory of 3028	3876	18581044dbdf0b557aeb81598217c07c29ad2e2cd6b7dd600fe0aa64997a3803.exe	18581044dbdf0b557aeb81598217c07c29ad2e2cd6b7dd600fe0aa64997a3803.exe
PID 3876 wrote to memory of 3028	3876	18581044dbdf0b557aeb81598217c07c29ad2e2cd6b7dd600fe0aa64997a3803.exe	18581044dbdf0b557aeb81598217c07c29ad2e2cd6b7dd600fe0aa64997a3803.exe
PID 3876 wrote to memory of 3028	3876	18581044dbdf0b557aeb81598217c07c29ad2e2cd6b7dd600fe0aa64997a3803.exe	18581044dbdf0b557aeb81598217c07c29ad2e2cd6b7dd600fe0aa64997a3803.exe
PID 3876 wrote to memory of 3028	3876	18581044dbdf0b557aeb81598217c07c29ad2e2cd6b7dd600fe0aa64997a3803.exe	18581044dbdf0b557aeb81598217c07c29ad2e2cd6b7dd600fe0aa64997a3803.exe
PID 3876 wrote to memory of 3028	3876	18581044dbdf0b557aeb81598217c07c29ad2e2cd6b7dd600fe0aa64997a3803.exe	18581044dbdf0b557aeb81598217c07c29ad2e2cd6b7dd600fe0aa64997a3803.exe
PID 3876 wrote to memory of 3028	3876	18581044dbdf0b557aeb81598217c07c29ad2e2cd6b7dd600fe0aa64997a3803.exe	18581044dbdf0b557aeb81598217c07c29ad2e2cd6b7dd600fe0aa64997a3803.exe
PID 3876 wrote to memory of 3028	3876	18581044dbdf0b557aeb81598217c07c29ad2e2cd6b7dd600fe0aa64997a3803.exe	18581044dbdf0b557aeb81598217c07c29ad2e2cd6b7dd600fe0aa64997a3803.exe

C:\Users\Admin\AppData\Local\Temp\18581044dbdf0b557aeb81598217c07c29ad2e2cd6b7dd600fe0aa64997a3803.exe
"C:\Users\Admin\AppData\Local\Temp\18581044dbdf0b557aeb81598217c07c29ad2e2cd6b7dd600fe0aa64997a3803.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3876

C:\Users\Admin\AppData\Local\Temp\18581044dbdf0b557aeb81598217c07c29ad2e2cd6b7dd600fe0aa64997a3803.exe
"{path}"
2⤵
PID:3028

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3028-115-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3028-116-0x000000000041A1F8-mapping.dmp

Download
memory/3028-117-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3876-114-0x0000000000EF0000-0x000000000103A000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing