azorult | 44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e | Triage

Analysis

max time kernel
148s
max time network
149s
platform
windows10_x64
resource
win10v20210410
submitted
30-04-2021 04:01

Sharing

Report Analysis Logs

General

Target

f07c3008_by_Libranalysis.exe
Size

930KB
MD5

f07c300806da3a9c9a55bc7037db2bb7
SHA1

5b89e3c5706647945eeb5d3d10b7bdf4a60bf264
SHA256

44a553892af9e23cabd74bef11e9bc8fe08dd0f111a482248f90e8d2f54ae06e
SHA512

5b68c7a137c40aa86eccf5bbb5ae526a630fc7a239b81673b9c253998b4b4369b0a0e08784f77d85f3a64c44eb0247ba8771c351a66d59b193501c6aff2fcf9b

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://31.210.20.121/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

f07c3008_by_Libranalysis.exe

description pid process target process

PID 1744 set thread context of 3132 1744 f07c3008_by_Libranalysis.exe f07c3008_by_Libranalysis.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

f07c3008_by_Libranalysis.exe

description	pid	process	target process
PID 1744 wrote to memory of 3132	1744	f07c3008_by_Libranalysis.exe	f07c3008_by_Libranalysis.exe
PID 1744 wrote to memory of 3132	1744	f07c3008_by_Libranalysis.exe	f07c3008_by_Libranalysis.exe
PID 1744 wrote to memory of 3132	1744	f07c3008_by_Libranalysis.exe	f07c3008_by_Libranalysis.exe
PID 1744 wrote to memory of 3132	1744	f07c3008_by_Libranalysis.exe	f07c3008_by_Libranalysis.exe
PID 1744 wrote to memory of 3132	1744	f07c3008_by_Libranalysis.exe	f07c3008_by_Libranalysis.exe
PID 1744 wrote to memory of 3132	1744	f07c3008_by_Libranalysis.exe	f07c3008_by_Libranalysis.exe
PID 1744 wrote to memory of 3132	1744	f07c3008_by_Libranalysis.exe	f07c3008_by_Libranalysis.exe
PID 1744 wrote to memory of 3132	1744	f07c3008_by_Libranalysis.exe	f07c3008_by_Libranalysis.exe
PID 1744 wrote to memory of 3132	1744	f07c3008_by_Libranalysis.exe	f07c3008_by_Libranalysis.exe

C:\Users\Admin\AppData\Local\Temp\f07c3008_by_Libranalysis.exe
"C:\Users\Admin\AppData\Local\Temp\f07c3008_by_Libranalysis.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1744

C:\Users\Admin\AppData\Local\Temp\f07c3008_by_Libranalysis.exe
"{path}"
2⤵
PID:3132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1744-114-0x00000000017B0000-0x00000000017B1000-memory.dmp

Filesize
4KB

Download
memory/3132-115-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3132-116-0x000000000041A1F8-mapping.dmp

Download
memory/3132-117-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download