azorult | abb8146908e34fbd71e48b8923e734b496e9957cf850674659f1a591bf2000c2

Analysis

Target

PICTURE FOR ILLUSTRATION.exe
Size

212KB
MD5

025030d30646897352afc77898f4014b
SHA1

cb6edbf932827a5d92b39e74cbd1f3c7992fa1f1
SHA256

229aaa16670e60669a955690e0104fdd3e0e2621974b11d6dbb9804aea38f963
SHA512

58cb66cc15886a67af396342fec8a7923a78818103b967d853944c9640768cae5624dc04ee821c9f9142b2bcb9887477de202538ba06a7f8ee8ddc5771da3d1e

Score

10^/10

Family

azorult

http://217.160.246.104/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

PICTURE FOR ILLUSTRATION.exe

description pid process target process

PID 3948 set thread context of 3376 3948 PICTURE FOR ILLUSTRATION.exe PICTURE FOR ILLUSTRATION.exe

description	pid	process	target process
PID 3948 set thread context of 3376	3948	PICTURE FOR ILLUSTRATION.exe	PICTURE FOR ILLUSTRATION.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

PICTURE FOR ILLUSTRATION.exe

description	pid	process	target process
PID 3948 wrote to memory of 3376	3948	PICTURE FOR ILLUSTRATION.exe	PICTURE FOR ILLUSTRATION.exe
PID 3948 wrote to memory of 3376	3948	PICTURE FOR ILLUSTRATION.exe	PICTURE FOR ILLUSTRATION.exe
PID 3948 wrote to memory of 3376	3948	PICTURE FOR ILLUSTRATION.exe	PICTURE FOR ILLUSTRATION.exe
PID 3948 wrote to memory of 3376	3948	PICTURE FOR ILLUSTRATION.exe	PICTURE FOR ILLUSTRATION.exe
PID 3948 wrote to memory of 3376	3948	PICTURE FOR ILLUSTRATION.exe	PICTURE FOR ILLUSTRATION.exe
PID 3948 wrote to memory of 3376	3948	PICTURE FOR ILLUSTRATION.exe	PICTURE FOR ILLUSTRATION.exe
PID 3948 wrote to memory of 3376	3948	PICTURE FOR ILLUSTRATION.exe	PICTURE FOR ILLUSTRATION.exe
PID 3948 wrote to memory of 3376	3948	PICTURE FOR ILLUSTRATION.exe	PICTURE FOR ILLUSTRATION.exe
PID 3948 wrote to memory of 3376	3948	PICTURE FOR ILLUSTRATION.exe	PICTURE FOR ILLUSTRATION.exe

C:\Users\Admin\AppData\Local\Temp\PICTURE FOR ILLUSTRATION.exe
"{path}"
2⤵
PID:3376

memory/3376-134-0x0000000000000000-mapping.dmp

Download
memory/3376-135-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3376-137-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3376-138-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3948-130-0x0000000000210000-0x000000000024C000-memory.dmp

Filesize
240KB

Download
memory/3948-131-0x0000000004B80000-0x0000000004C1C000-memory.dmp

Filesize
624KB

Download
memory/3948-132-0x0000000004CC0000-0x0000000004D52000-memory.dmp

Filesize
584KB

Download
memory/3948-133-0x0000000005880000-0x0000000005E24000-memory.dmp

Filesize
5.6MB

Download