azorult | c4bf2c83d68522e70bd6b9134303948a4f943fc9e464e66dad40b91b02fae65e

Analysis

max time kernel
111s
max time network
127s
platform
windows10_x64
resource
win10-en-20211208
submitted
26/01/2022, 08:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RFQ2622#.exe
Size 541KB
Sample220126-j81pkabbf8
SHA256 c4bf2c83d68522e70bd6b9134303948a4f943fc9e464e66dad40b91b02fae65e
MD5 3a56c3e08f4004faeab7c0ab91c2a205
SHA1 6f9944efe836a5615206b7af44e9f26c22b54557
SHA512 c068fa41ee4a60925d3d300768851ce2607c1f710ad45227083239cb3913106e403e11b4bfaf2f2821728bd8510a1a3e29e434d0f3b8d961274ea50445677b87
MD5 SHA1 SHA512

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://212.192.246.12/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2504 set thread context of 3460	2504	RFQ2622#.exe	71

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2504	RFQ2622#.exe
2504	RFQ2622#.exe
2504	RFQ2622#.exe
2504	RFQ2622#.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2504	RFQ2622#.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 3996	2504	RFQ2622#.exe	69
PID 2504 wrote to memory of 3996	2504	RFQ2622#.exe	69
PID 2504 wrote to memory of 3996	2504	RFQ2622#.exe	69
PID 2504 wrote to memory of 3332	2504	RFQ2622#.exe	70
PID 2504 wrote to memory of 3332	2504	RFQ2622#.exe	70
PID 2504 wrote to memory of 3332	2504	RFQ2622#.exe	70
PID 2504 wrote to memory of 3460	2504	RFQ2622#.exe	71
PID 2504 wrote to memory of 3460	2504	RFQ2622#.exe	71
PID 2504 wrote to memory of 3460	2504	RFQ2622#.exe	71
PID 2504 wrote to memory of 3460	2504	RFQ2622#.exe	71
PID 2504 wrote to memory of 3460	2504	RFQ2622#.exe	71
PID 2504 wrote to memory of 3460	2504	RFQ2622#.exe	71
PID 2504 wrote to memory of 3460	2504	RFQ2622#.exe	71
PID 2504 wrote to memory of 3460	2504	RFQ2622#.exe	71
PID 2504 wrote to memory of 3460	2504	RFQ2622#.exe	71

C:\Users\Admin\AppData\Local\Temp\RFQ2622#.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ2622#.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Users\Admin\AppData\Local\Temp\RFQ2622#.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ2622#.exe"
  2⤵
  PID:3996
- C:\Users\Admin\AppData\Local\Temp\RFQ2622#.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ2622#.exe"
  2⤵
  PID:3332
- C:\Users\Admin\AppData\Local\Temp\RFQ2622#.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ2622#.exe"
  2⤵
  PID:3460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2504-118-0x00000000001B0000-0x000000000023C000-memory.dmp

Download

memory/2504-119-0x0000000004FC0000-0x00000000054BE000-memory.dmp

Download

memory/2504-120-0x0000000004AC0000-0x0000000004B52000-memory.dmp

Download

memory/2504-121-0x0000000004A90000-0x0000000004A9A000-memory.dmp

Download

memory/2504-122-0x00000000049D0000-0x0000000004A62000-memory.dmp

Download

memory/2504-123-0x0000000006EF0000-0x0000000006F8C000-memory.dmp

Download

memory/2504-124-0x000000007F3F0000-0x000000007F3F1000-memory.dmp

Download

memory/2504-125-0x0000000006FA0000-0x0000000006FAC000-memory.dmp

Download

memory/2504-126-0x00000000074E0000-0x0000000007538000-memory.dmp

Download

memory/3460-127-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3460-128-0x0000000000400000-0x0000000000420000-memory.dmp

Download