azorult | 44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e

General

Target

44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e.exe
Size

930KB
MD5

f07c300806da3a9c9a55bc7037db2bb7
SHA1

5b89e3c5706647945eeb5d3d10b7bdf4a60bf264
SHA256

44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e
SHA512

5b68c7a137c40aa86eccf5bbb5ae526a630fc7a239b81673b9c253998b4b4369b0a0e08784f77d85f3a64c44eb0247ba8771c351a66d59b193501c6aff2fcf9b

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://31.210.20.121/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e.exe

description	pid	process	target process
PID 1628 set thread context of 316	1628	44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e.exe	44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e.exe

description	pid	process	target process
PID 1628 wrote to memory of 316	1628	44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e.exe	44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e.exe
PID 1628 wrote to memory of 316	1628	44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e.exe	44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e.exe
PID 1628 wrote to memory of 316	1628	44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e.exe	44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e.exe
PID 1628 wrote to memory of 316	1628	44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e.exe	44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e.exe
PID 1628 wrote to memory of 316	1628	44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e.exe	44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e.exe
PID 1628 wrote to memory of 316	1628	44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e.exe	44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e.exe
PID 1628 wrote to memory of 316	1628	44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e.exe	44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e.exe
PID 1628 wrote to memory of 316	1628	44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e.exe	44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e.exe
PID 1628 wrote to memory of 316	1628	44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e.exe	44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e.exe
PID 1628 wrote to memory of 316	1628	44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e.exe	44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e.exe

C:\Users\Admin\AppData\Local\Temp\44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e.exe
"C:\Users\Admin\AppData\Local\Temp\44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1628

C:\Users\Admin\AppData\Local\Temp\44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e.exe
"{path}"
2⤵
PID:316

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/316-64-0x000000000041A1F8-mapping.dmp

Download
memory/316-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/316-66-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1628-60-0x0000000075551000-0x0000000075553000-memory.dmp

Filesize
8KB

Download
memory/1628-61-0x0000000000110000-0x0000000000111000-memory.dmp

Filesize
4KB

Download
memory/1628-62-0x0000000000111000-0x0000000000112000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing