azorult | 8c4ab34b4aa53718967d637c28aab7064f71b6cecba58bdf1e589f98d14ee9a3

General

Target

PRQ 010474.exe
Size

312KB
MD5

86552be6b1f4a2a5ee6f4d3314bcaca8
SHA1

273c38764bc244f6322939e899cd111c56df9772
SHA256

ed15459a7fd8570fc69235cac35dbe1617fa919c6c09a1978df30952b2af53b1
SHA512

b5a71794e75c4fab472639e47fd2c2717c7e14894527e498dafa7690ab02a54c3b543362e6b79dc17185a66c87652b1ecfc6a6c2a8fc9f46af2fd7d6a8f85491

Score

10^/10

Family

azorult

C2

http://128.199.141.181/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

Processes:

resource	yara_rule
behavioral1/memory/2028-56-0x00000000007D0000-0x00000000007FA000-memory.dmp	rezer0

Suspicious use of SetThreadContext 1 IoCs

Processes:

PRQ 010474.exe

description pid process target process

PID 2028 set thread context of 1268 2028 PRQ 010474.exe PRQ 010474.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

PRQ 010474.exe

pid process

2028 PRQ 010474.exe
2028 PRQ 010474.exe
2028 PRQ 010474.exe
2028 PRQ 010474.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

PRQ 010474.exe

description pid process

Token: SeDebugPrivilege 2028 PRQ 010474.exe

description	pid	process	target process
PID 2028 set thread context of 1268	2028	PRQ 010474.exe	PRQ 010474.exe

description	pid	process
Token: SeDebugPrivilege	2028	PRQ 010474.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

PRQ 010474.exe

description	pid	process	target process
PID 2028 wrote to memory of 1240	2028	PRQ 010474.exe	PRQ 010474.exe
PID 2028 wrote to memory of 1240	2028	PRQ 010474.exe	PRQ 010474.exe
PID 2028 wrote to memory of 1240	2028	PRQ 010474.exe	PRQ 010474.exe
PID 2028 wrote to memory of 1240	2028	PRQ 010474.exe	PRQ 010474.exe
PID 2028 wrote to memory of 1268	2028	PRQ 010474.exe	PRQ 010474.exe
PID 2028 wrote to memory of 1268	2028	PRQ 010474.exe	PRQ 010474.exe
PID 2028 wrote to memory of 1268	2028	PRQ 010474.exe	PRQ 010474.exe
PID 2028 wrote to memory of 1268	2028	PRQ 010474.exe	PRQ 010474.exe
PID 2028 wrote to memory of 1268	2028	PRQ 010474.exe	PRQ 010474.exe
PID 2028 wrote to memory of 1268	2028	PRQ 010474.exe	PRQ 010474.exe
PID 2028 wrote to memory of 1268	2028	PRQ 010474.exe	PRQ 010474.exe
PID 2028 wrote to memory of 1268	2028	PRQ 010474.exe	PRQ 010474.exe
PID 2028 wrote to memory of 1268	2028	PRQ 010474.exe	PRQ 010474.exe
PID 2028 wrote to memory of 1268	2028	PRQ 010474.exe	PRQ 010474.exe

memory/1268-61-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1268-57-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1268-58-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1268-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1268-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1268-64-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1268-65-0x000000000041A1F8-mapping.dmp

Download
memory/1268-67-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1268-68-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/1268-69-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2028-55-0x00000000002F0000-0x0000000000304000-memory.dmp

Filesize
80KB

Download
memory/2028-56-0x00000000007D0000-0x00000000007FA000-memory.dmp

Filesize
168KB

Download
memory/2028-54-0x00000000009E0000-0x0000000000A34000-memory.dmp

Filesize
336KB

Download