azorult | 2214bdc78b558176a17484bcc02079a5470e0b49073d50d19b522d67dc4396e3

Analysis

Target

219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe
Size

135KB
MD5

164076414dd3be991ebc9d4d17101296
SHA1

0fa986a6834c79eb1b756b1a05954d96a770e4d7
SHA256

219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0
SHA512

16e004f19d1466142d190094f7dfa0a89e61b45f1e1e161822fb0934635dfd514bf00c4020bfa6fbf2f177c1491f528be9f66fcc15f6f1ca1ecc897d01cd9d21

Score

10^/10

Family

azorult

http://cskbtr.atspace.co.uk/my_profile/res/

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Executes dropped EXE 1 IoCs

pid	Process
3796	windowsmediaplayer.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 568 set thread context of 3796	568	219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe	77

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 568 wrote to memory of 3796	568	219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe	77
PID 568 wrote to memory of 3796	568	219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe	77
PID 568 wrote to memory of 3796	568	219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe	77
PID 568 wrote to memory of 3796	568	219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe	77
PID 568 wrote to memory of 3796	568	219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe	77
PID 568 wrote to memory of 3796	568	219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe	77
PID 568 wrote to memory of 3796	568	219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe	77
PID 568 wrote to memory of 3796	568	219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe	77
PID 568 wrote to memory of 3796	568	219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe	77
PID 568 wrote to memory of 3796	568	219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe	77

C:\Users\Admin\AppData\Local\Temp\219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe
"C:\Users\Admin\AppData\Local\Temp\219156c02502e38cfd6273b4293f737b8404c043de6df402b322e813f3a223f0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:568
- C:\Users\Admin\AppData\Local\Temp\windowsmediaplayer.exe
  C:\Users\Admin\AppData\Local\Temp\windowsmediaplayer.exe
  2⤵
  - Executes dropped EXE
  PID:3796

memory/568-114-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/568-116-0x00000000053E0000-0x00000000053E1000-memory.dmp

Filesize
4KB

Download
memory/568-117-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

Filesize
4KB

Download
memory/568-118-0x0000000004E80000-0x0000000004E81000-memory.dmp

Filesize
4KB

Download
memory/568-119-0x0000000004E20000-0x0000000004E21000-memory.dmp

Filesize
4KB

Download
memory/568-120-0x0000000005110000-0x0000000005111000-memory.dmp

Filesize
4KB

Download
memory/3796-121-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3796-125-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download