azorult | 8d55fa987ac27e338c576cccaf4cc008e0e569bf69fd77899d68c1ba6f1e2671

General

Target

PI16374.PDF.exe
Size

1.5MB
MD5

f71d3143f27b590ab8d787750d42886f
SHA1

440779da502e50fc247f6b7f912a0cef0ee6ada3
SHA256

8d55fa987ac27e338c576cccaf4cc008e0e569bf69fd77899d68c1ba6f1e2671
SHA512

3d89c4ff32de09fc3ec195fb5dd9b033406d70f9d956e2a998889ae28952b7b488c96ca00a2b82569b874d6beecece4f3a53830f94d7436e686da8940460a9de

Score

10^/10

Family

azorult

C2

http://203.159.80.91/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

PI16374.PDF.exe

description pid process target process

PID 1808 set thread context of 3388 1808 PI16374.PDF.exe PI16374.PDF.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

PI16374.PDF.exe

pid process

1808 PI16374.PDF.exe
1808 PI16374.PDF.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

PI16374.PDF.exe

description pid process

Token: SeDebugPrivilege 1808 PI16374.PDF.exe

description	pid	process	target process
PID 1808 set thread context of 3388	1808	PI16374.PDF.exe	PI16374.PDF.exe

pid	process
1808	PI16374.PDF.exe
1808	PI16374.PDF.exe

description	pid	process
Token: SeDebugPrivilege	1808	PI16374.PDF.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

PI16374.PDF.exe

description	pid	process	target process
PID 1808 wrote to memory of 3080	1808	PI16374.PDF.exe	PI16374.PDF.exe
PID 1808 wrote to memory of 3080	1808	PI16374.PDF.exe	PI16374.PDF.exe
PID 1808 wrote to memory of 3080	1808	PI16374.PDF.exe	PI16374.PDF.exe
PID 1808 wrote to memory of 3388	1808	PI16374.PDF.exe	PI16374.PDF.exe
PID 1808 wrote to memory of 3388	1808	PI16374.PDF.exe	PI16374.PDF.exe
PID 1808 wrote to memory of 3388	1808	PI16374.PDF.exe	PI16374.PDF.exe
PID 1808 wrote to memory of 3388	1808	PI16374.PDF.exe	PI16374.PDF.exe
PID 1808 wrote to memory of 3388	1808	PI16374.PDF.exe	PI16374.PDF.exe
PID 1808 wrote to memory of 3388	1808	PI16374.PDF.exe	PI16374.PDF.exe
PID 1808 wrote to memory of 3388	1808	PI16374.PDF.exe	PI16374.PDF.exe
PID 1808 wrote to memory of 3388	1808	PI16374.PDF.exe	PI16374.PDF.exe
PID 1808 wrote to memory of 3388	1808	PI16374.PDF.exe	PI16374.PDF.exe

memory/1808-114-0x0000000000920000-0x0000000000921000-memory.dmp

Filesize
4KB

Download
memory/1808-116-0x0000000005890000-0x0000000005891000-memory.dmp

Filesize
4KB

Download
memory/1808-117-0x00000000052D0000-0x00000000052D1000-memory.dmp

Filesize
4KB

Download
memory/1808-118-0x00000000054F0000-0x00000000054F1000-memory.dmp

Filesize
4KB

Download
memory/1808-119-0x0000000005390000-0x0000000005391000-memory.dmp

Filesize
4KB

Download
memory/1808-120-0x0000000007810000-0x0000000007811000-memory.dmp

Filesize
4KB

Download
memory/1808-121-0x0000000005390000-0x000000000588E000-memory.dmp

Filesize
5.0MB

Download
memory/1808-122-0x00000000054D0000-0x00000000054DE000-memory.dmp

Filesize
56KB

Download
memory/1808-123-0x00000000078B0000-0x000000000791A000-memory.dmp

Filesize
424KB

Download
memory/1808-124-0x0000000007680000-0x000000000769E000-memory.dmp

Filesize
120KB

Download
memory/3388-125-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3388-126-0x000000000041A1F8-mapping.dmp

Download
memory/3388-127-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download