azorult | ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea

General

Target

ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe
Size

818KB
MD5

125438b4356eee3414e5c5b7c4ec9127
SHA1

4942710e1825eed916eda47aec95b8b7ac5296c3
SHA256

ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea
SHA512

5f761773cf734ef974fbc35c092bc91f610877a680fcf17eebfd05b21be7bb6cb4ef1f8b2b0532bdc5d58095fdc4aa2b0dd02bf26a97dcbd77a78a5c3be57cdf

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://149.248.35.254/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe

description	pid	process	target process
PID 640 set thread context of 2184	640	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe

description	pid	process	target process
PID 640 wrote to memory of 2184	640	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe
PID 640 wrote to memory of 2184	640	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe
PID 640 wrote to memory of 2184	640	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe
PID 640 wrote to memory of 2184	640	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe
PID 640 wrote to memory of 2184	640	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe
PID 640 wrote to memory of 2184	640	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe
PID 640 wrote to memory of 2184	640	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe
PID 640 wrote to memory of 2184	640	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe
PID 640 wrote to memory of 2184	640	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe	ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe

C:\Users\Admin\AppData\Local\Temp\ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe
"C:\Users\Admin\AppData\Local\Temp\ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:640
- C:\Users\Admin\AppData\Local\Temp\ec04b37597a0bb8591e6c1a33a5b53399b7d97037016f1a762b19a780ae386ea.exe
  "{path}"
  2⤵
  PID:2184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/640-114-0x00000000008F0000-0x0000000000A3A000-memory.dmp

Filesize
1.3MB

Download
memory/2184-115-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2184-116-0x000000000041A1F8-mapping.dmp

Download
memory/2184-117-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing