azorult | b23e01d42c1f482619a0a48fd54cce6df591ddd201438b217c44abd1193e5ec8 | Triage

Analysis

max time kernel
166s
max time network
178s
platform
windows10_x64
resource
win10-en-20210920
submitted
27-09-2021 08:03

Sharing

Report Analysis Logs

General

Target

Product List.exe
Size

1.4MB
MD5

6548f31c17e336768e0dc8bdcd8b293b
SHA1

9c0d6dacf960acf973782af7ec749fd7941d2916
SHA256

b23e01d42c1f482619a0a48fd54cce6df591ddd201438b217c44abd1193e5ec8
SHA512

0d977fe28432b958eda8cfc06556f00f353c7e4874381f056e0d38f0adc0d253038759d4bbbe01c834c9b884fa0ed0a6803d3966445b365d1e43e15f5d819654

Score

10^/10

azorult infostealer trojan

Malware Config

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

Product List.exe

description pid process target process

PID 2472 set thread context of 2696 2472 Product List.exe Product List.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Product List.exe

description	pid	process	target process
PID 2472 wrote to memory of 2696	2472	Product List.exe	Product List.exe
PID 2472 wrote to memory of 2696	2472	Product List.exe	Product List.exe
PID 2472 wrote to memory of 2696	2472	Product List.exe	Product List.exe
PID 2472 wrote to memory of 2696	2472	Product List.exe	Product List.exe
PID 2472 wrote to memory of 2696	2472	Product List.exe	Product List.exe
PID 2472 wrote to memory of 2696	2472	Product List.exe	Product List.exe
PID 2472 wrote to memory of 2696	2472	Product List.exe	Product List.exe
PID 2472 wrote to memory of 2696	2472	Product List.exe	Product List.exe
PID 2472 wrote to memory of 2696	2472	Product List.exe	Product List.exe

C:\Users\Admin\AppData\Local\Temp\Product List.exe
"C:\Users\Admin\AppData\Local\Temp\Product List.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2472

C:\Users\Admin\AppData\Local\Temp\Product List.exe
"{path}"
2⤵
PID:2696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2472-115-0x0000000003220000-0x0000000003221000-memory.dmp

Filesize
4KB

Download
memory/2472-116-0x0000000003221000-0x0000000003222000-memory.dmp

Filesize
4KB

Download
memory/2696-117-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2696-118-0x000000000041A1F8-mapping.dmp

Download
memory/2696-119-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download