azorult | fafd08b980a830ba65a48aefe7bb5aebcd2c6ff85e2306aa1db16524e1e12bcb

General

Target

fafd08b980a830ba65a48aefe7bb5aebcd2c6ff85e2306aa1db16524e1e12bcb.exe
Size

765KB
MD5

ebb7f1fd0d624285840b21988f19ee55
SHA1

73ffda324b2a290efffc740d27130c386712ebb6
SHA256

fafd08b980a830ba65a48aefe7bb5aebcd2c6ff85e2306aa1db16524e1e12bcb
SHA512

fdadf89e05694dfdbd92af584e587e805afc9a2d0c67413ded188dd12728216e5e3598cba6d39167136c46319a7600b7f525c053e1668cde95c9f019cd7adb4a

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://104.238.137.224/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

fafd08b980a830ba65a48aefe7bb5aebcd2c6ff85e2306aa1db16524e1e12bcb.exe

description	pid	process	target process
PID 1988 set thread context of 360	1988	fafd08b980a830ba65a48aefe7bb5aebcd2c6ff85e2306aa1db16524e1e12bcb.exe	fafd08b980a830ba65a48aefe7bb5aebcd2c6ff85e2306aa1db16524e1e12bcb.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

fafd08b980a830ba65a48aefe7bb5aebcd2c6ff85e2306aa1db16524e1e12bcb.exe

description	pid	process	target process
PID 1988 wrote to memory of 360	1988	fafd08b980a830ba65a48aefe7bb5aebcd2c6ff85e2306aa1db16524e1e12bcb.exe	fafd08b980a830ba65a48aefe7bb5aebcd2c6ff85e2306aa1db16524e1e12bcb.exe
PID 1988 wrote to memory of 360	1988	fafd08b980a830ba65a48aefe7bb5aebcd2c6ff85e2306aa1db16524e1e12bcb.exe	fafd08b980a830ba65a48aefe7bb5aebcd2c6ff85e2306aa1db16524e1e12bcb.exe
PID 1988 wrote to memory of 360	1988	fafd08b980a830ba65a48aefe7bb5aebcd2c6ff85e2306aa1db16524e1e12bcb.exe	fafd08b980a830ba65a48aefe7bb5aebcd2c6ff85e2306aa1db16524e1e12bcb.exe
PID 1988 wrote to memory of 360	1988	fafd08b980a830ba65a48aefe7bb5aebcd2c6ff85e2306aa1db16524e1e12bcb.exe	fafd08b980a830ba65a48aefe7bb5aebcd2c6ff85e2306aa1db16524e1e12bcb.exe
PID 1988 wrote to memory of 360	1988	fafd08b980a830ba65a48aefe7bb5aebcd2c6ff85e2306aa1db16524e1e12bcb.exe	fafd08b980a830ba65a48aefe7bb5aebcd2c6ff85e2306aa1db16524e1e12bcb.exe
PID 1988 wrote to memory of 360	1988	fafd08b980a830ba65a48aefe7bb5aebcd2c6ff85e2306aa1db16524e1e12bcb.exe	fafd08b980a830ba65a48aefe7bb5aebcd2c6ff85e2306aa1db16524e1e12bcb.exe
PID 1988 wrote to memory of 360	1988	fafd08b980a830ba65a48aefe7bb5aebcd2c6ff85e2306aa1db16524e1e12bcb.exe	fafd08b980a830ba65a48aefe7bb5aebcd2c6ff85e2306aa1db16524e1e12bcb.exe
PID 1988 wrote to memory of 360	1988	fafd08b980a830ba65a48aefe7bb5aebcd2c6ff85e2306aa1db16524e1e12bcb.exe	fafd08b980a830ba65a48aefe7bb5aebcd2c6ff85e2306aa1db16524e1e12bcb.exe
PID 1988 wrote to memory of 360	1988	fafd08b980a830ba65a48aefe7bb5aebcd2c6ff85e2306aa1db16524e1e12bcb.exe	fafd08b980a830ba65a48aefe7bb5aebcd2c6ff85e2306aa1db16524e1e12bcb.exe
PID 1988 wrote to memory of 360	1988	fafd08b980a830ba65a48aefe7bb5aebcd2c6ff85e2306aa1db16524e1e12bcb.exe	fafd08b980a830ba65a48aefe7bb5aebcd2c6ff85e2306aa1db16524e1e12bcb.exe

C:\Users\Admin\AppData\Local\Temp\fafd08b980a830ba65a48aefe7bb5aebcd2c6ff85e2306aa1db16524e1e12bcb.exe
"C:\Users\Admin\AppData\Local\Temp\fafd08b980a830ba65a48aefe7bb5aebcd2c6ff85e2306aa1db16524e1e12bcb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1988

C:\Users\Admin\AppData\Local\Temp\fafd08b980a830ba65a48aefe7bb5aebcd2c6ff85e2306aa1db16524e1e12bcb.exe
"{path}"
2⤵
PID:360

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/360-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/360-64-0x000000000041A1F8-mapping.dmp

Download
memory/360-66-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1988-60-0x0000000075B31000-0x0000000075B33000-memory.dmp

Filesize
8KB

Download
memory/1988-61-0x0000000000940000-0x0000000000941000-memory.dmp

Filesize
4KB

Download
memory/1988-62-0x0000000000941000-0x0000000000942000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing