azorult | ba55368a4cbd51083a053855134ef2744b9d246191babfa7a74af7d86177a2b8

Analysis

Target
PICTURE FOR ILLUSTRATION.exe
Size 263KB
Sample220521-a9rcvaeegn
SHA256 5447c2be0b0ec772c186a81fc56b8b1b30827b5298f1b05a9d6cb70e31a6901d
MD5 835611e9c72462089c241d518923c5a3
SHA1 dbc1c55264ce5e0f163341eacfa9c8869be78dc5
SHA512 09811a7ba54651007a6b07fce2a79baafd1100d2742c82af6427829a9d3ae964565c629fa9fa8cc0d3fa182bf3ea4481cfa446fdb1218d905700ffd7061f3859
MD5 SHA1 SHA512

Score

10^/10

Family

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1232 set thread context of 5060	1232	PICTURE FOR ILLUSTRATION.exe	90

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1232	PICTURE FOR ILLUSTRATION.exe
1232	PICTURE FOR ILLUSTRATION.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1232	PICTURE FOR ILLUSTRATION.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 5028	1232	PICTURE FOR ILLUSTRATION.exe	89
PID 1232 wrote to memory of 5028	1232	PICTURE FOR ILLUSTRATION.exe	89
PID 1232 wrote to memory of 5028	1232	PICTURE FOR ILLUSTRATION.exe	89
PID 1232 wrote to memory of 5060	1232	PICTURE FOR ILLUSTRATION.exe	90
PID 1232 wrote to memory of 5060	1232	PICTURE FOR ILLUSTRATION.exe	90
PID 1232 wrote to memory of 5060	1232	PICTURE FOR ILLUSTRATION.exe	90
PID 1232 wrote to memory of 5060	1232	PICTURE FOR ILLUSTRATION.exe	90
PID 1232 wrote to memory of 5060	1232	PICTURE FOR ILLUSTRATION.exe	90
PID 1232 wrote to memory of 5060	1232	PICTURE FOR ILLUSTRATION.exe	90
PID 1232 wrote to memory of 5060	1232	PICTURE FOR ILLUSTRATION.exe	90
PID 1232 wrote to memory of 5060	1232	PICTURE FOR ILLUSTRATION.exe	90
PID 1232 wrote to memory of 5060	1232	PICTURE FOR ILLUSTRATION.exe	90

C:\Users\Admin\AppData\Local\Temp\PICTURE FOR ILLUSTRATION.exe
"C:\Users\Admin\AppData\Local\Temp\PICTURE FOR ILLUSTRATION.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Users\Admin\AppData\Local\Temp\PICTURE FOR ILLUSTRATION.exe
  "{path}"
  2⤵
  PID:5028
- C:\Users\Admin\AppData\Local\Temp\PICTURE FOR ILLUSTRATION.exe
  "{path}"
  2⤵
  PID:5060

memory/1232-130-0x0000000075370000-0x0000000075921000-memory.dmp

Download

memory/5060-133-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/5060-135-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/5060-136-0x0000000000400000-0x0000000000420000-memory.dmp

Download