azorult | e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314

General

Target

e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314.exe
Size

520KB
MD5

4563d090652511869535ca150032d8cd
SHA1

193d52cd2f859edcba26e429e8794366f6a16822
SHA256

e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314
SHA512

c087598ea4fbc095e55001b38139ffbb33b5ed65d5edc5b4923ac0cf37e5695ccc3d8bf8c7b34ff5fb1778ebb6540e62be61075bb9afe837cb6edee74f953c50

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

https://www.ausvanlines.com.au/cloudflare/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314.exe

description	pid	process	target process
PID 4908 set thread context of 3492	4908	e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314.exe	e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314.exe

pid	process
4908	e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314.exe
4908	e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314.exe

description pid process

Token: SeDebugPrivilege 4908 e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314.exe

description	pid	process
Token: SeDebugPrivilege	4908	e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314.exe

description	pid	process	target process
PID 4908 wrote to memory of 3492	4908	e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314.exe	e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314.exe
PID 4908 wrote to memory of 3492	4908	e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314.exe	e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314.exe
PID 4908 wrote to memory of 3492	4908	e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314.exe	e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314.exe
PID 4908 wrote to memory of 3492	4908	e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314.exe	e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314.exe
PID 4908 wrote to memory of 3492	4908	e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314.exe	e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314.exe
PID 4908 wrote to memory of 3492	4908	e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314.exe	e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314.exe
PID 4908 wrote to memory of 3492	4908	e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314.exe	e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314.exe
PID 4908 wrote to memory of 3492	4908	e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314.exe	e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314.exe
PID 4908 wrote to memory of 3492	4908	e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314.exe	e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314.exe

C:\Users\Admin\AppData\Local\Temp\e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314.exe
"C:\Users\Admin\AppData\Local\Temp\e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4908

C:\Users\Admin\AppData\Local\Temp\e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314.exe
"C:\Users\Admin\AppData\Local\Temp\e6a7ac6ef3bd624f8bb3f19e8904331211c6d37b64d1e1a40bf0246b8f301314.exe"
2⤵
PID:3492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3492-136-0x0000000000000000-mapping.dmp

Download
memory/3492-137-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3492-139-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3492-140-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4908-130-0x0000000000410000-0x0000000000498000-memory.dmp

Filesize
544KB

Download
memory/4908-131-0x0000000004E00000-0x0000000004E9C000-memory.dmp

Filesize
624KB

Download
memory/4908-132-0x0000000005500000-0x0000000005AA4000-memory.dmp

Filesize
5.6MB

Download
memory/4908-133-0x0000000005C50000-0x0000000005CE2000-memory.dmp

Filesize
584KB

Download
memory/4908-134-0x0000000005DF0000-0x0000000005DFA000-memory.dmp

Filesize
40KB

Download
memory/4908-135-0x000000000D7A0000-0x000000000D7C2000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads