azorult | db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f

General

Target

db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe
Size

650KB
MD5

9d544edbac1411fd5c7ce439100680f8
SHA1

6ef2e1a2e35533777478b3b4f9b7d67c5a53b69d
SHA256

db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f
SHA512

e415c48ef9390a3ce7c09af437acfa56b8ed72d5c2718f3ddea36e14eae42bb81d380b6efd7373b182a1c590421f33864c5a7bd7b4e278429fa863f83a45953c

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://31.210.21.194/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe

description	pid	process	target process
PID 1748 set thread context of 1312	1748	db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe	db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe

pid	process
1748	db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe
1748	db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe

description pid process

Token: SeDebugPrivilege 1748 db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe

description	pid	process
Token: SeDebugPrivilege	1748	db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe

description	pid	process	target process
PID 1748 wrote to memory of 868	1748	db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe	db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe
PID 1748 wrote to memory of 868	1748	db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe	db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe
PID 1748 wrote to memory of 868	1748	db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe	db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe
PID 1748 wrote to memory of 868	1748	db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe	db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe
PID 1748 wrote to memory of 1312	1748	db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe	db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe
PID 1748 wrote to memory of 1312	1748	db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe	db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe
PID 1748 wrote to memory of 1312	1748	db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe	db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe
PID 1748 wrote to memory of 1312	1748	db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe	db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe
PID 1748 wrote to memory of 1312	1748	db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe	db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe
PID 1748 wrote to memory of 1312	1748	db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe	db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe
PID 1748 wrote to memory of 1312	1748	db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe	db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe
PID 1748 wrote to memory of 1312	1748	db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe	db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe
PID 1748 wrote to memory of 1312	1748	db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe	db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe
PID 1748 wrote to memory of 1312	1748	db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe	db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe

C:\Users\Admin\AppData\Local\Temp\db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe
"C:\Users\Admin\AppData\Local\Temp\db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1748

C:\Users\Admin\AppData\Local\Temp\db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe
"{path}"
2⤵
PID:868

C:\Users\Admin\AppData\Local\Temp\db983ec8265e31a052ec43b742f1f266225f09d07a6a6a67947fbaabb42ef73f.exe
"{path}"
2⤵
PID:1312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1312-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1312-64-0x000000000041A1F8-mapping.dmp

Download
memory/1312-66-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1748-60-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/1748-61-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1748-62-0x00000000001E1000-0x00000000001E2000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads