azorult | 7a9066bddd272c50102198fae4c4bade59f8a33e6c99a5f06330ec0025b2fcb4

Analysis

Target

7a9066bddd272c50102198fae4c4bade59f8a33e6c99a5f06330ec0025b2fcb4.exe
Size

595KB
MD5

566fb9ff64f07845f2c82bfeb5aa2c02
SHA1

0a135164092adedbbd69ec7a073149e216efae50
SHA256

7a9066bddd272c50102198fae4c4bade59f8a33e6c99a5f06330ec0025b2fcb4
SHA512

1953cd400526e8e261c54dec41b3097d164738f2865d99d2134de560254e737acd9d30fca523894cd1e520c7d005d7839059eb2748c554c35f01e00818403a8f

Score

10^/10

Family

azorult

http://85.202.169.121/mann/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

7a9066bddd272c50102198fae4c4bade59f8a33e6c99a5f06330ec0025b2fcb4.exe

description	pid	process	target process
PID 5032 set thread context of 1340	5032	7a9066bddd272c50102198fae4c4bade59f8a33e6c99a5f06330ec0025b2fcb4.exe	aspnet_compiler.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

7a9066bddd272c50102198fae4c4bade59f8a33e6c99a5f06330ec0025b2fcb4.exe

description pid process

Token: SeDebugPrivilege 5032 7a9066bddd272c50102198fae4c4bade59f8a33e6c99a5f06330ec0025b2fcb4.exe

description	pid	process
Token: SeDebugPrivilege	5032	7a9066bddd272c50102198fae4c4bade59f8a33e6c99a5f06330ec0025b2fcb4.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

7a9066bddd272c50102198fae4c4bade59f8a33e6c99a5f06330ec0025b2fcb4.exe

description	pid	process	target process
PID 5032 wrote to memory of 1340	5032	7a9066bddd272c50102198fae4c4bade59f8a33e6c99a5f06330ec0025b2fcb4.exe	aspnet_compiler.exe
PID 5032 wrote to memory of 1340	5032	7a9066bddd272c50102198fae4c4bade59f8a33e6c99a5f06330ec0025b2fcb4.exe	aspnet_compiler.exe
PID 5032 wrote to memory of 1340	5032	7a9066bddd272c50102198fae4c4bade59f8a33e6c99a5f06330ec0025b2fcb4.exe	aspnet_compiler.exe
PID 5032 wrote to memory of 1340	5032	7a9066bddd272c50102198fae4c4bade59f8a33e6c99a5f06330ec0025b2fcb4.exe	aspnet_compiler.exe
PID 5032 wrote to memory of 1340	5032	7a9066bddd272c50102198fae4c4bade59f8a33e6c99a5f06330ec0025b2fcb4.exe	aspnet_compiler.exe
PID 5032 wrote to memory of 1340	5032	7a9066bddd272c50102198fae4c4bade59f8a33e6c99a5f06330ec0025b2fcb4.exe	aspnet_compiler.exe
PID 5032 wrote to memory of 1340	5032	7a9066bddd272c50102198fae4c4bade59f8a33e6c99a5f06330ec0025b2fcb4.exe	aspnet_compiler.exe
PID 5032 wrote to memory of 1340	5032	7a9066bddd272c50102198fae4c4bade59f8a33e6c99a5f06330ec0025b2fcb4.exe	aspnet_compiler.exe
PID 5032 wrote to memory of 1340	5032	7a9066bddd272c50102198fae4c4bade59f8a33e6c99a5f06330ec0025b2fcb4.exe	aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
2⤵
PID:1340

memory/1340-132-0x0000000000000000-mapping.dmp

Download
memory/1340-133-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1340-135-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1340-136-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5032-130-0x0000000000F00000-0x0000000000F8E000-memory.dmp

Filesize
568KB

Download
memory/5032-131-0x0000000005920000-0x00000000059BC000-memory.dmp

Filesize
624KB

Download