azorult | 60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6

General

Target

60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe
Size

443KB
MD5

21c891db70bc3aa3ec9d015b0fc12692
SHA1

ae592b5a328129f2ec0531dd87c6f28f87b39567
SHA256

60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6
SHA512

1e95aff4ff14ca155aa2b7625e2b95f787a6098c08e2d48ac39c8ba398c92f40d4cfa343e4ed6c71716cfca827bd4eea5c3aa1db12f7f9a04175b796bf9dfaa8

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://casabayshops.co/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe

description	pid	process	target process
PID 1824 set thread context of 1964	1824	60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe	60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe

description	pid	process	target process
PID 1824 wrote to memory of 1964	1824	60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe	60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe
PID 1824 wrote to memory of 1964	1824	60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe	60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe
PID 1824 wrote to memory of 1964	1824	60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe	60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe
PID 1824 wrote to memory of 1964	1824	60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe	60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe
PID 1824 wrote to memory of 1964	1824	60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe	60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe
PID 1824 wrote to memory of 1964	1824	60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe	60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe
PID 1824 wrote to memory of 1964	1824	60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe	60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe
PID 1824 wrote to memory of 1964	1824	60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe	60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe
PID 1824 wrote to memory of 1964	1824	60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe	60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe

C:\Users\Admin\AppData\Local\Temp\60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe
"C:\Users\Admin\AppData\Local\Temp\60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1824

C:\Users\Admin\AppData\Local\Temp\60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe
"C:\Users\Admin\AppData\Local\Temp\60c3f88e80bd7604779b3653fe2bc26ecde37dc1177d7528c43c3fe843d0d5c6.exe"
2⤵
PID:1964

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1824-59-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download
memory/1824-60-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1964-61-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1964-62-0x000000000041A1F8-mapping.dmp

Download
memory/1964-64-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing