azorult | 8085b13eb5097f9107ef826115461f4ff755b81c5ec97b3378f2325d06651d2c

Analysis

Target

egdgh.exe
Size

839KB
MD5

5d751931eb3477f5e7d340606b381db2
SHA1

011c86381eabf328aa69260b0812ae534d950101
SHA256

8085b13eb5097f9107ef826115461f4ff755b81c5ec97b3378f2325d06651d2c
SHA512

965076d7d98f3265fb58d075e4e17f4d73086af64ec32fa042cbe3e2a717796ec2ecafc0cd755d39c5c208aa85b210bbd17096666bca0086eb04d7e31ebbedc5

Score

10^/10

Family

azorult

http://itthonfiatalon.hu/temp/reo/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M17
suricata
Suspicious use of SetThreadContext 1 IoCs

Processes:

egdgh.exe

description pid process target process

PID 2156 set thread context of 3104 2156 egdgh.exe egdgh.exe

description	pid	process	target process
PID 2156 set thread context of 3104	2156	egdgh.exe	egdgh.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

egdgh.exe

description	pid	process	target process
PID 2156 wrote to memory of 3104	2156	egdgh.exe	egdgh.exe
PID 2156 wrote to memory of 3104	2156	egdgh.exe	egdgh.exe
PID 2156 wrote to memory of 3104	2156	egdgh.exe	egdgh.exe
PID 2156 wrote to memory of 3104	2156	egdgh.exe	egdgh.exe
PID 2156 wrote to memory of 3104	2156	egdgh.exe	egdgh.exe
PID 2156 wrote to memory of 3104	2156	egdgh.exe	egdgh.exe
PID 2156 wrote to memory of 3104	2156	egdgh.exe	egdgh.exe
PID 2156 wrote to memory of 3104	2156	egdgh.exe	egdgh.exe
PID 2156 wrote to memory of 3104	2156	egdgh.exe	egdgh.exe

C:\Users\Admin\AppData\Local\Temp\egdgh.exe
"C:\Users\Admin\AppData\Local\Temp\egdgh.exe"
2⤵
PID:3104

memory/2156-114-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

Filesize
4KB

Download
memory/2156-116-0x00000000059C0000-0x00000000059C1000-memory.dmp

Filesize
4KB

Download
memory/2156-117-0x0000000005F60000-0x0000000005F61000-memory.dmp

Filesize
4KB

Download
memory/2156-118-0x0000000005A60000-0x0000000005A61000-memory.dmp

Filesize
4KB

Download
memory/2156-119-0x00000000032E0000-0x00000000032E1000-memory.dmp

Filesize
4KB

Download
memory/2156-120-0x0000000005CC0000-0x0000000005CC1000-memory.dmp

Filesize
4KB

Download
memory/2156-121-0x00000000058E0000-0x000000000597C000-memory.dmp

Filesize
624KB

Download
memory/2156-122-0x0000000005D70000-0x0000000005D8B000-memory.dmp

Filesize
108KB

Download
memory/2156-123-0x0000000005B00000-0x0000000005B68000-memory.dmp

Filesize
416KB

Download
memory/2156-124-0x0000000003260000-0x0000000003282000-memory.dmp

Filesize
136KB

Download
memory/3104-125-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3104-126-0x000000000041A1F8-mapping.dmp

Download
memory/3104-127-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download