azorult | 2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b

General

Target

2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe
Size

1.1MB
MD5

e71412a5c1941bdbc7a971f1fe697a94
SHA1

7799685dcde975e611d8c907c2916fc5be67b381
SHA256

2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b
SHA512

ed1a53d5bf29c842e1aeb40aaae80578a262b96477c043d02a4638eea6e8293ace1be55e9636d3d7c94f93daa9f7b03dc6e7790623e6502d34b5031836f9e2ce

Score

10^/10

azorult infostealer suricata trojan

Malware Config

Extracted

Family

azorult

C2

http://62.197.136.186/kendrick/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M6
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M6
suricata

Suspicious use of SetThreadContext 1 IoCs

Processes:

2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe

description	pid	process	target process
PID 956 set thread context of 1136	956	2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe	2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe

description	pid	process	target process
PID 956 wrote to memory of 1136	956	2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe	2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe
PID 956 wrote to memory of 1136	956	2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe	2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe
PID 956 wrote to memory of 1136	956	2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe	2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe
PID 956 wrote to memory of 1136	956	2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe	2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe
PID 956 wrote to memory of 1136	956	2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe	2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe
PID 956 wrote to memory of 1136	956	2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe	2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe
PID 956 wrote to memory of 1136	956	2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe	2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe
PID 956 wrote to memory of 1136	956	2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe	2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe
PID 956 wrote to memory of 1136	956	2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe	2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe
PID 956 wrote to memory of 1136	956	2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe	2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe

C:\Users\Admin\AppData\Local\Temp\2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe
"C:\Users\Admin\AppData\Local\Temp\2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:956
- C:\Users\Admin\AppData\Local\Temp\2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe
  "C:\Users\Admin\AppData\Local\Temp\2b625c9d95399334aa265623e7341745fb784c71c293935b68d892b6939fa09b.exe"
  2⤵
  PID:1136

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/956-54-0x0000000001190000-0x00000000012AC000-memory.dmp

Filesize
1.1MB

Download
memory/956-55-0x00000000764C1000-0x00000000764C3000-memory.dmp

Filesize
8KB

Download
memory/956-56-0x00000000005A0000-0x00000000005B2000-memory.dmp

Filesize
72KB

Download
memory/956-57-0x00000000059F0000-0x0000000005ADC000-memory.dmp

Filesize
944KB

Download
memory/956-58-0x00000000009C0000-0x00000000009E2000-memory.dmp

Filesize
136KB

Download
memory/1136-59-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1136-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1136-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1136-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1136-64-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1136-67-0x000000000041A684-mapping.dmp

Download
memory/1136-66-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1136-69-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1136-71-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing