azorult | 8085b13eb5097f9107ef826115461f4ff755b81c5ec97b3378f2325d06651d2c

Analysis

Target

egdgh.exe
Size

839KB
MD5

5d751931eb3477f5e7d340606b381db2
SHA1

011c86381eabf328aa69260b0812ae534d950101
SHA256

8085b13eb5097f9107ef826115461f4ff755b81c5ec97b3378f2325d06651d2c
SHA512

965076d7d98f3265fb58d075e4e17f4d73086af64ec32fa042cbe3e2a717796ec2ecafc0cd755d39c5c208aa85b210bbd17096666bca0086eb04d7e31ebbedc5

Score

10^/10

Family

azorult

http://itthonfiatalon.hu/temp/reo/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M1
suricata
Suspicious use of SetThreadContext 1 IoCs

Processes:

egdgh.exe

description pid process target process

PID 1820 set thread context of 524 1820 egdgh.exe egdgh.exe

description	pid	process	target process
PID 1820 set thread context of 524	1820	egdgh.exe	egdgh.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

egdgh.exe

description	pid	process	target process
PID 1820 wrote to memory of 524	1820	egdgh.exe	egdgh.exe
PID 1820 wrote to memory of 524	1820	egdgh.exe	egdgh.exe
PID 1820 wrote to memory of 524	1820	egdgh.exe	egdgh.exe
PID 1820 wrote to memory of 524	1820	egdgh.exe	egdgh.exe
PID 1820 wrote to memory of 524	1820	egdgh.exe	egdgh.exe
PID 1820 wrote to memory of 524	1820	egdgh.exe	egdgh.exe
PID 1820 wrote to memory of 524	1820	egdgh.exe	egdgh.exe
PID 1820 wrote to memory of 524	1820	egdgh.exe	egdgh.exe
PID 1820 wrote to memory of 524	1820	egdgh.exe	egdgh.exe
PID 1820 wrote to memory of 524	1820	egdgh.exe	egdgh.exe

C:\Users\Admin\AppData\Local\Temp\egdgh.exe
"C:\Users\Admin\AppData\Local\Temp\egdgh.exe"
2⤵
PID:524

memory/524-66-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/524-67-0x000000000041A1F8-mapping.dmp

Download
memory/524-68-0x0000000076641000-0x0000000076643000-memory.dmp

Filesize
8KB

Download
memory/524-69-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1820-60-0x0000000000870000-0x0000000000871000-memory.dmp

Filesize
4KB

Download
memory/1820-62-0x00000000048B0000-0x00000000048B1000-memory.dmp

Filesize
4KB

Download
memory/1820-63-0x0000000000530000-0x000000000054B000-memory.dmp

Filesize
108KB

Download
memory/1820-64-0x0000000004FA0000-0x0000000005008000-memory.dmp

Filesize
416KB

Download
memory/1820-65-0x0000000004390000-0x00000000043B2000-memory.dmp

Filesize
136KB

Download