azorult | ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea

General

Target

ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe
Size

818KB
MD5

125438b4356eee3414e5c5b7c4ec9127
SHA1

4942710e1825eed916eda47aec95b8b7ac5296c3
SHA256

ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea
SHA512

5f761773cf734ef974fbc35c092bc91f610877a680fcf17eebfd05b21be7bb6cb4ef1f8b2b0532bdc5d58095fdc4aa2b0dd02bf26a97dcbd77a78a5c3be57cdf

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://149.248.35.254/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe

description	pid	process	target process
PID 788 set thread context of 884	788	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe

description	pid	process	target process
PID 788 wrote to memory of 884	788	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe
PID 788 wrote to memory of 884	788	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe
PID 788 wrote to memory of 884	788	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe
PID 788 wrote to memory of 884	788	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe
PID 788 wrote to memory of 884	788	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe
PID 788 wrote to memory of 884	788	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe
PID 788 wrote to memory of 884	788	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe
PID 788 wrote to memory of 884	788	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe
PID 788 wrote to memory of 884	788	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe
PID 788 wrote to memory of 884	788	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe

C:\Users\Admin\AppData\Local\Temp\ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe
"C:\Users\Admin\AppData\Local\Temp\ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:788

C:\Users\Admin\AppData\Local\Temp\ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe
"{path}"
2⤵
PID:884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/788-60-0x0000000002180000-0x0000000002181000-memory.dmp

Filesize
4KB

Download
memory/788-61-0x0000000075AA1000-0x0000000075AA3000-memory.dmp

Filesize
8KB

Download
memory/788-62-0x0000000002181000-0x0000000002182000-memory.dmp

Filesize
4KB

Download
memory/884-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/884-64-0x000000000041A1F8-mapping.dmp

Download
memory/884-66-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing