azorult | 6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199

General

Target

6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe
Size

863KB
MD5

e31a855d80f25a0e2773816c7ca9e248
SHA1

41dd5cc5dbd88d16f03eab4824b9ba06e1ad496f
SHA256

6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199
SHA512

98f558f8ef3e3198cb2b57c0a3693b29b155e17be93616659eb37e46729b6277c767a74f5a5529ecd0d128e7f695b7f5cca9a08fd061bfa169fb0867e30a33ed

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://89.43.107.198/mpom/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe

description	pid	process	target process
PID 2064 set thread context of 1824	2064	6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe	6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe

description	pid	process	target process
PID 2064 wrote to memory of 1824	2064	6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe	6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe
PID 2064 wrote to memory of 1824	2064	6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe	6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe
PID 2064 wrote to memory of 1824	2064	6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe	6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe
PID 2064 wrote to memory of 1824	2064	6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe	6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe
PID 2064 wrote to memory of 1824	2064	6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe	6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe
PID 2064 wrote to memory of 1824	2064	6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe	6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe
PID 2064 wrote to memory of 1824	2064	6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe	6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe
PID 2064 wrote to memory of 1824	2064	6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe	6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe
PID 2064 wrote to memory of 1824	2064	6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe	6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe

C:\Users\Admin\AppData\Local\Temp\6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe
"C:\Users\Admin\AppData\Local\Temp\6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Users\Admin\AppData\Local\Temp\6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe
  "C:\Users\Admin\AppData\Local\Temp\6096e3f747f713f30077f7859617eda384bbd368e994d81ee90a8bf1ddab6199.exe"
  2⤵
  PID:1824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1824-135-0x0000000000000000-mapping.dmp

Download
memory/1824-136-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1824-138-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1824-139-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2064-130-0x00000000001C0000-0x000000000029E000-memory.dmp

Filesize
888KB

Download
memory/2064-131-0x00000000051B0000-0x0000000005754000-memory.dmp

Filesize
5.6MB

Download
memory/2064-132-0x0000000004CA0000-0x0000000004D32000-memory.dmp

Filesize
584KB

Download
memory/2064-133-0x0000000004C50000-0x0000000004C5A000-memory.dmp

Filesize
40KB

Download
memory/2064-134-0x0000000007200000-0x000000000729C000-memory.dmp

Filesize
624KB

Download

Analysis

Sharing