azorult | 8c4ab34b4aa53718967d637c28aab7064f71b6cecba58bdf1e589f98d14ee9a3

Analysis

Target

PRQ 010474.exe
Size

312KB
MD5

86552be6b1f4a2a5ee6f4d3314bcaca8
SHA1

273c38764bc244f6322939e899cd111c56df9772
SHA256

ed15459a7fd8570fc69235cac35dbe1617fa919c6c09a1978df30952b2af53b1
SHA512

b5a71794e75c4fab472639e47fd2c2717c7e14894527e498dafa7690ab02a54c3b543362e6b79dc17185a66c87652b1ecfc6a6c2a8fc9f46af2fd7d6a8f85491

Score

10^/10

Family

azorult

http://128.199.141.181/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

PRQ 010474.exe

description pid process target process

PID 4268 set thread context of 4512 4268 PRQ 010474.exe PRQ 010474.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

PRQ 010474.exe

pid process

4268 PRQ 010474.exe
4268 PRQ 010474.exe
4268 PRQ 010474.exe
4268 PRQ 010474.exe
4268 PRQ 010474.exe
4268 PRQ 010474.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

PRQ 010474.exe

description pid process

Token: SeDebugPrivilege 4268 PRQ 010474.exe

description	pid	process	target process
PID 4268 set thread context of 4512	4268	PRQ 010474.exe	PRQ 010474.exe

description	pid	process
Token: SeDebugPrivilege	4268	PRQ 010474.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

PRQ 010474.exe

description	pid	process	target process
PID 4268 wrote to memory of 4364	4268	PRQ 010474.exe	PRQ 010474.exe
PID 4268 wrote to memory of 4364	4268	PRQ 010474.exe	PRQ 010474.exe
PID 4268 wrote to memory of 4364	4268	PRQ 010474.exe	PRQ 010474.exe
PID 4268 wrote to memory of 4512	4268	PRQ 010474.exe	PRQ 010474.exe
PID 4268 wrote to memory of 4512	4268	PRQ 010474.exe	PRQ 010474.exe
PID 4268 wrote to memory of 4512	4268	PRQ 010474.exe	PRQ 010474.exe
PID 4268 wrote to memory of 4512	4268	PRQ 010474.exe	PRQ 010474.exe
PID 4268 wrote to memory of 4512	4268	PRQ 010474.exe	PRQ 010474.exe
PID 4268 wrote to memory of 4512	4268	PRQ 010474.exe	PRQ 010474.exe
PID 4268 wrote to memory of 4512	4268	PRQ 010474.exe	PRQ 010474.exe
PID 4268 wrote to memory of 4512	4268	PRQ 010474.exe	PRQ 010474.exe
PID 4268 wrote to memory of 4512	4268	PRQ 010474.exe	PRQ 010474.exe

memory/4268-130-0x00000000002B0000-0x0000000000304000-memory.dmp

Filesize
336KB

Download
memory/4268-131-0x00000000079D0000-0x0000000007F74000-memory.dmp

Filesize
5.6MB

Download
memory/4268-132-0x0000000007520000-0x00000000075B2000-memory.dmp

Filesize
584KB

Download
memory/4268-133-0x0000000007660000-0x00000000076FC000-memory.dmp

Filesize
624KB

Download
memory/4364-134-0x0000000000000000-mapping.dmp

Download
memory/4512-135-0x0000000000000000-mapping.dmp

Download
memory/4512-136-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4512-138-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4512-139-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download