azorult | 2214bdc78b558176a17484bcc02079a5470e0b49073d50d19b522d67dc4396e3

Analysis

max time kernel
22s
max time network
125s
platform
windows10_x64
resource
win10v20210408
submitted
30-07-2021 15:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe
Size

135KB
MD5

164076414dd3be991ebc9d4d17101296
SHA1

0fa986a6834c79eb1b756b1a05954d96a770e4d7
SHA256

219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0
SHA512

16e004f19d1466142d190094f7dfa0a89e61b45f1e1e161822fb0934635dfd514bf00c4020bfa6fbf2f177c1491f528be9f66fcc15f6f1ca1ecc897d01cd9d21

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://cskbtr.atspace.co.uk/my_profile/res/

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Executes dropped EXE 1 IoCs

Processes:

windowsmediaplayer.exe

pid process

3796 windowsmediaplayer.exe

pid	process
3796	windowsmediaplayer.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe

description	pid	process	target process
PID 568 set thread context of 3796	568	219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe	windowsmediaplayer.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe

description	pid	process	target process
PID 568 wrote to memory of 3796	568	219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe	windowsmediaplayer.exe
PID 568 wrote to memory of 3796	568	219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe	windowsmediaplayer.exe
PID 568 wrote to memory of 3796	568	219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe	windowsmediaplayer.exe
PID 568 wrote to memory of 3796	568	219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe	windowsmediaplayer.exe
PID 568 wrote to memory of 3796	568	219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe	windowsmediaplayer.exe
PID 568 wrote to memory of 3796	568	219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe	windowsmediaplayer.exe
PID 568 wrote to memory of 3796	568	219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe	windowsmediaplayer.exe
PID 568 wrote to memory of 3796	568	219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe	windowsmediaplayer.exe
PID 568 wrote to memory of 3796	568	219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe	windowsmediaplayer.exe
PID 568 wrote to memory of 3796	568	219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe	windowsmediaplayer.exe

C:\Users\Admin\AppData\Local\Temp\219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe
"C:\Users\Admin\AppData\Local\Temp\219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:568

C:\Users\Admin\AppData\Local\Temp\windowsmediaplayer.exe
C:\Users\Admin\AppData\Local\Temp\windowsmediaplayer.exe
2⤵
- Executes dropped EXE
PID:3796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\windowsmediaplayer.exe
MD5
dd0ee56841e535a3a3ae7c20c32de9cd

SHA1
fc1ea172fd3c67a00e37f930f7595784fc0d1f84

SHA256
8649df38276968d1417ec064360339610ff644491c87eb8ac2b2e67e7cbe47c9

SHA512
ee6a7982e194a5a24f5bd596d1ad6582defcababa19ea8011ba71ead2ee8945dce9f5af56e47b088c16ca00cb6c7225cc18b9b6f026e623283c0e02f9bed524e

Download Submit
C:\Users\Admin\AppData\Local\Temp\windowsmediaplayer.exe
MD5
dd0ee56841e535a3a3ae7c20c32de9cd

SHA1
fc1ea172fd3c67a00e37f930f7595784fc0d1f84

SHA256
8649df38276968d1417ec064360339610ff644491c87eb8ac2b2e67e7cbe47c9

SHA512
ee6a7982e194a5a24f5bd596d1ad6582defcababa19ea8011ba71ead2ee8945dce9f5af56e47b088c16ca00cb6c7225cc18b9b6f026e623283c0e02f9bed524e

Download Submit
memory/568-114-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/568-116-0x00000000053E0000-0x00000000053E1000-memory.dmp

Filesize
4KB

Download
memory/568-117-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

Filesize
4KB

Download
memory/568-118-0x0000000004E80000-0x0000000004E81000-memory.dmp

Filesize
4KB

Download
memory/568-119-0x0000000004E20000-0x0000000004E21000-memory.dmp

Filesize
4KB

Download
memory/568-120-0x0000000005110000-0x0000000005111000-memory.dmp

Filesize
4KB

Download
memory/3796-122-0x000000000041A684-mapping.dmp

Download
memory/3796-121-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3796-125-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download