azorult | 2214bdc78b558176a17484bcc02079a5470e0b49073d50d19b522d67dc4396e3

Analysis

Target

219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe
Size

135KB
MD5

164076414dd3be991ebc9d4d17101296
SHA1

0fa986a6834c79eb1b756b1a05954d96a770e4d7
SHA256

219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0
SHA512

16e004f19d1466142d190094f7dfa0a89e61b45f1e1e161822fb0934635dfd514bf00c4020bfa6fbf2f177c1491f528be9f66fcc15f6f1ca1ecc897d01cd9d21

Score

10^/10

Family

azorult

http://cskbtr.atspace.co.uk/my_profile/res/

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Executes dropped EXE 1 IoCs

Processes:

windowsmediaplayer.exe

pid process

908 windowsmediaplayer.exe
Loads dropped DLL 1 IoCs

Processes:

219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe

pid process

1924 219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe

pid	process
908	windowsmediaplayer.exe

pid	process
1924	219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe

description	pid	process	target process
PID 1924 set thread context of 908	1924	219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe	windowsmediaplayer.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe

description	pid	process	target process
PID 1924 wrote to memory of 908	1924	219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe	windowsmediaplayer.exe
PID 1924 wrote to memory of 908	1924	219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe	windowsmediaplayer.exe
PID 1924 wrote to memory of 908	1924	219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe	windowsmediaplayer.exe
PID 1924 wrote to memory of 908	1924	219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe	windowsmediaplayer.exe
PID 1924 wrote to memory of 908	1924	219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe	windowsmediaplayer.exe
PID 1924 wrote to memory of 908	1924	219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe	windowsmediaplayer.exe
PID 1924 wrote to memory of 908	1924	219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe	windowsmediaplayer.exe
PID 1924 wrote to memory of 908	1924	219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe	windowsmediaplayer.exe
PID 1924 wrote to memory of 908	1924	219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe	windowsmediaplayer.exe
PID 1924 wrote to memory of 908	1924	219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe	windowsmediaplayer.exe

C:\Users\Admin\AppData\Local\Temp\windowsmediaplayer.exe
C:\Users\Admin\AppData\Local\Temp\windowsmediaplayer.exe
2⤵
- Executes dropped EXE
PID:908

C:\Users\Admin\AppData\Local\Temp\windowsmediaplayer.exe
MD5
ed797d8dc2c92401985d162e42ffa450

SHA1
0f02fc517c7facc4baefde4fe9467fb6488ebabe

SHA256
b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e

SHA512
e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

Download Submit
\Users\Admin\AppData\Local\Temp\windowsmediaplayer.exe
MD5
ed797d8dc2c92401985d162e42ffa450

SHA1
0f02fc517c7facc4baefde4fe9467fb6488ebabe

SHA256
b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e

SHA512
e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

Download Submit
memory/908-65-0x000000000041A684-mapping.dmp

Download
memory/908-64-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/908-67-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1924-59-0x0000000000980000-0x0000000000981000-memory.dmp

Filesize
4KB

Download
memory/1924-61-0x0000000076691000-0x0000000076693000-memory.dmp

Filesize
8KB

Download
memory/1924-62-0x0000000004D20000-0x0000000004D21000-memory.dmp

Filesize
4KB

Download