azorult | d286ce0a72c3053c61909e492d314b3008ca872a80ea60e29b9d0ec728e6dc62 | Triage

Analysis

max time kernel
120s
max time network
125s
platform
windows10_x64
resource
win10v20210410
submitted
28-04-2021 06:05

Sharing

Report Analysis Logs

General

Target

#PO - NHM4500737680MHP.exe
Size

772KB
MD5

d8eaf9779ee87f05f529886275525256
SHA1

1a48704cc10874e0ba88a01a68e635b6e2d10183
SHA256

d286ce0a72c3053c61909e492d314b3008ca872a80ea60e29b9d0ec728e6dc62
SHA512

a173fcc3789f95ac670d73be7798c0b2773964c807e683b69ef63ea6ddbc60d3ae9be9996e372ce5182725458d4af62086bd3798f2e68e31d9a52294127db9cc

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://13.233.97.208/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

#PO - NHM4500737680MHP.exe

description pid process target process

PID 3904 set thread context of 3288 3904 #PO - NHM4500737680MHP.exe #PO - NHM4500737680MHP.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

#PO - NHM4500737680MHP.exe

description	pid	process	target process
PID 3904 wrote to memory of 3288	3904	#PO - NHM4500737680MHP.exe	#PO - NHM4500737680MHP.exe
PID 3904 wrote to memory of 3288	3904	#PO - NHM4500737680MHP.exe	#PO - NHM4500737680MHP.exe
PID 3904 wrote to memory of 3288	3904	#PO - NHM4500737680MHP.exe	#PO - NHM4500737680MHP.exe
PID 3904 wrote to memory of 3288	3904	#PO - NHM4500737680MHP.exe	#PO - NHM4500737680MHP.exe
PID 3904 wrote to memory of 3288	3904	#PO - NHM4500737680MHP.exe	#PO - NHM4500737680MHP.exe
PID 3904 wrote to memory of 3288	3904	#PO - NHM4500737680MHP.exe	#PO - NHM4500737680MHP.exe
PID 3904 wrote to memory of 3288	3904	#PO - NHM4500737680MHP.exe	#PO - NHM4500737680MHP.exe
PID 3904 wrote to memory of 3288	3904	#PO - NHM4500737680MHP.exe	#PO - NHM4500737680MHP.exe
PID 3904 wrote to memory of 3288	3904	#PO - NHM4500737680MHP.exe	#PO - NHM4500737680MHP.exe

C:\Users\Admin\AppData\Local\Temp\#PO - NHM4500737680MHP.exe
"C:\Users\Admin\AppData\Local\Temp\#PO - NHM4500737680MHP.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3904

C:\Users\Admin\AppData\Local\Temp\#PO - NHM4500737680MHP.exe
"{path}"
2⤵
PID:3288

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3288-115-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3288-116-0x000000000041A1F8-mapping.dmp

Download
memory/3288-117-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3904-114-0x0000000002E90000-0x0000000002E91000-memory.dmp

Filesize
4KB

Download