azorult | 44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e | Triage

Analysis

max time kernel
40s
max time network
112s
platform
windows10_x64
resource
win10v20210408
submitted
30-04-2021 02:53

Sharing

Report Analysis Logs

General

Target

633.exe
Size

930KB
MD5

f07c300806da3a9c9a55bc7037db2bb7
SHA1

5b89e3c5706647945eeb5d3d10b7bdf4a60bf264
SHA256

44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e
SHA512

5b68c7a137c40aa86eccf5bbb5ae526a630fc7a239b81673b9c253998b4b4369b0a0e08784f77d85f3a64c44eb0247ba8771c351a66d59b193501c6aff2fcf9b

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://31.210.20.121/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

633.exe

description pid process target process

PID 4804 set thread context of 3056 4804 633.exe 633.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

633.exe

description	pid	process	target process
PID 4804 wrote to memory of 3056	4804	633.exe	633.exe
PID 4804 wrote to memory of 3056	4804	633.exe	633.exe
PID 4804 wrote to memory of 3056	4804	633.exe	633.exe
PID 4804 wrote to memory of 3056	4804	633.exe	633.exe
PID 4804 wrote to memory of 3056	4804	633.exe	633.exe
PID 4804 wrote to memory of 3056	4804	633.exe	633.exe
PID 4804 wrote to memory of 3056	4804	633.exe	633.exe
PID 4804 wrote to memory of 3056	4804	633.exe	633.exe
PID 4804 wrote to memory of 3056	4804	633.exe	633.exe

C:\Users\Admin\AppData\Local\Temp\633.exe
"C:\Users\Admin\AppData\Local\Temp\633.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Users\Admin\AppData\Local\Temp\633.exe
  "{path}"
  2⤵
  PID:3056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3056-115-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3056-116-0x000000000041A1F8-mapping.dmp

Download
memory/3056-117-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4804-114-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download