azorult | 99d4d18e906e44d3b08aede8237928a7a6866378516bd07695f2bca4fc8a954f

Analysis

Target

RFQ PC00056942.exe
Size

285KB
MD5

49226c62012170c00a4cccae8d61c363
SHA1

aa1af05c892e18e611f153263bd5582536243de6
SHA256

b7867882baba4d27ac04f4b537b20a90166c5d3c82247f84ed338cf7cafba649
SHA512

6a56506a92148ada8a9e0562fc6bc18c594cd4047108e9921d8d15ef5499b9628674b54ef37ed32a9c345c9c4ab43b4f983bd4ca77320da374991ef41f518da7

Score

10^/10

Family

azorult

http://217.160.254.33/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

RFQ PC00056942.exe

description pid process target process

PID 2340 set thread context of 2948 2340 RFQ PC00056942.exe RFQ PC00056942.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

RFQ PC00056942.exe

pid process

2340 RFQ PC00056942.exe
2340 RFQ PC00056942.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RFQ PC00056942.exe

description pid process

Token: SeDebugPrivilege 2340 RFQ PC00056942.exe

description	pid	process	target process
PID 2340 set thread context of 2948	2340	RFQ PC00056942.exe	RFQ PC00056942.exe

pid	process
2340	RFQ PC00056942.exe
2340	RFQ PC00056942.exe

description	pid	process
Token: SeDebugPrivilege	2340	RFQ PC00056942.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

RFQ PC00056942.exe

description	pid	process	target process
PID 2340 wrote to memory of 3388	2340	RFQ PC00056942.exe	RFQ PC00056942.exe
PID 2340 wrote to memory of 3388	2340	RFQ PC00056942.exe	RFQ PC00056942.exe
PID 2340 wrote to memory of 3388	2340	RFQ PC00056942.exe	RFQ PC00056942.exe
PID 2340 wrote to memory of 2948	2340	RFQ PC00056942.exe	RFQ PC00056942.exe
PID 2340 wrote to memory of 2948	2340	RFQ PC00056942.exe	RFQ PC00056942.exe
PID 2340 wrote to memory of 2948	2340	RFQ PC00056942.exe	RFQ PC00056942.exe
PID 2340 wrote to memory of 2948	2340	RFQ PC00056942.exe	RFQ PC00056942.exe
PID 2340 wrote to memory of 2948	2340	RFQ PC00056942.exe	RFQ PC00056942.exe
PID 2340 wrote to memory of 2948	2340	RFQ PC00056942.exe	RFQ PC00056942.exe
PID 2340 wrote to memory of 2948	2340	RFQ PC00056942.exe	RFQ PC00056942.exe
PID 2340 wrote to memory of 2948	2340	RFQ PC00056942.exe	RFQ PC00056942.exe
PID 2340 wrote to memory of 2948	2340	RFQ PC00056942.exe	RFQ PC00056942.exe

C:\Users\Admin\AppData\Local\Temp\RFQ PC00056942.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ PC00056942.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Users\Admin\AppData\Local\Temp\RFQ PC00056942.exe
  "{path}"
  2⤵
  PID:3388
- C:\Users\Admin\AppData\Local\Temp\RFQ PC00056942.exe
  "{path}"
  2⤵
  PID:2948

memory/2340-130-0x00000000009F0000-0x0000000000A3E000-memory.dmp

Filesize
312KB

Download
memory/2340-131-0x00000000059A0000-0x0000000005F44000-memory.dmp

Filesize
5.6MB

Download
memory/2340-132-0x00000000053F0000-0x0000000005482000-memory.dmp

Filesize
584KB

Download
memory/2340-133-0x00000000054A0000-0x00000000054AA000-memory.dmp

Filesize
40KB

Download
memory/2340-134-0x0000000005520000-0x0000000005532000-memory.dmp

Filesize
72KB

Download
memory/2340-135-0x0000000005F80000-0x0000000005FA2000-memory.dmp

Filesize
136KB

Download
memory/2340-136-0x0000000008F80000-0x000000000901C000-memory.dmp

Filesize
624KB

Download
memory/2948-138-0x0000000000000000-mapping.dmp

Download
memory/2948-139-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2948-141-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2948-142-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3388-137-0x0000000000000000-mapping.dmp

Download