azorult | 966ebd34704de02f70460bf2d4619b05deeb8c8ece5998242b5509b0e6ba80f2 | Triage

Analysis

max time kernel
315s
max time network
617s
platform
windows10_x64
resource
win10-en-20210920
submitted
24-09-2021 05:51

Sharing

Report Analysis Logs

General

Target

PO 329.exe
Size

796KB
MD5

6d27409795df8926a371b89c2becf85b
SHA1

8d0f35cca132ed6f9cb05b530ccd5063017adac5
SHA256

bfefbcaec340cf37802b09ece6b6f48906575f5ad21c1fd447103bf0c7b86e25
SHA512

77ee565a335efe59d1f5ec7ee389d773adfb1a2bb748183f9b42e50ca8b9608333a8d9e7284f9b1ed1c8e9bc5d7b7fb392b9de384cd312e679fd8f3350368aaa

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://159.65.165.243/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

PO 329.exe

description pid process target process

PID 2752 set thread context of 1008 2752 PO 329.exe PO 329.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

PO 329.exe

description	pid	process	target process
PID 2752 wrote to memory of 1008	2752	PO 329.exe	PO 329.exe
PID 2752 wrote to memory of 1008	2752	PO 329.exe	PO 329.exe
PID 2752 wrote to memory of 1008	2752	PO 329.exe	PO 329.exe
PID 2752 wrote to memory of 1008	2752	PO 329.exe	PO 329.exe
PID 2752 wrote to memory of 1008	2752	PO 329.exe	PO 329.exe
PID 2752 wrote to memory of 1008	2752	PO 329.exe	PO 329.exe
PID 2752 wrote to memory of 1008	2752	PO 329.exe	PO 329.exe
PID 2752 wrote to memory of 1008	2752	PO 329.exe	PO 329.exe
PID 2752 wrote to memory of 1008	2752	PO 329.exe	PO 329.exe

C:\Users\Admin\AppData\Local\Temp\PO 329.exe
"C:\Users\Admin\AppData\Local\Temp\PO 329.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2752

C:\Users\Admin\AppData\Local\Temp\PO 329.exe
"{path}"
2⤵
PID:1008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1008-117-0x000000000041A1F8-mapping.dmp

Download
memory/1008-116-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1008-119-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2752-115-0x0000000001890000-0x0000000001891000-memory.dmp

Filesize
4KB

Download
memory/2752-118-0x0000000001891000-0x0000000001892000-memory.dmp

Filesize
4KB

Download