azorult | 005e04a19875e8e122c919a7e8ef88b2d15efff1eadb8a30c4096e9194d52494

Analysis

Target

PRODUCT LIST.exe
Size

294KB
MD5

a42e195a8a3de45dc2bc88e33af006a4
SHA1

1ce81ed627893bb2cb4aa83b008dcd10c9203dae
SHA256

655455e4c04c7fd6e624b752797305264093264c08b0ab45ebfceee5f7abbc66
SHA512

2a08c7e3110e080d2377e7e25f7cc3f1ff936ceb5e59f5f763955578b68cafe10b8d260a6b3147d0bd6d127774a298181bca8ad6256f40a42318df31756de90c

Score

10^/10

Family

azorult

http://217.160.254.33/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

PRODUCT LIST.exe

description pid process target process

PID 3864 set thread context of 4668 3864 PRODUCT LIST.exe PRODUCT LIST.exe

description	pid	process	target process
PID 3864 set thread context of 4668	3864	PRODUCT LIST.exe	PRODUCT LIST.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

PRODUCT LIST.exe

description	pid	process	target process
PID 3864 wrote to memory of 4668	3864	PRODUCT LIST.exe	PRODUCT LIST.exe
PID 3864 wrote to memory of 4668	3864	PRODUCT LIST.exe	PRODUCT LIST.exe
PID 3864 wrote to memory of 4668	3864	PRODUCT LIST.exe	PRODUCT LIST.exe
PID 3864 wrote to memory of 4668	3864	PRODUCT LIST.exe	PRODUCT LIST.exe
PID 3864 wrote to memory of 4668	3864	PRODUCT LIST.exe	PRODUCT LIST.exe
PID 3864 wrote to memory of 4668	3864	PRODUCT LIST.exe	PRODUCT LIST.exe
PID 3864 wrote to memory of 4668	3864	PRODUCT LIST.exe	PRODUCT LIST.exe
PID 3864 wrote to memory of 4668	3864	PRODUCT LIST.exe	PRODUCT LIST.exe
PID 3864 wrote to memory of 4668	3864	PRODUCT LIST.exe	PRODUCT LIST.exe

memory/3864-130-0x0000000000D30000-0x0000000000D80000-memory.dmp

Filesize
320KB

Download
memory/3864-131-0x0000000005CA0000-0x0000000006244000-memory.dmp

Filesize
5.6MB

Download
memory/3864-132-0x0000000005790000-0x0000000005822000-memory.dmp

Filesize
584KB

Download
memory/3864-133-0x0000000005730000-0x000000000573A000-memory.dmp

Filesize
40KB

Download
memory/3864-134-0x0000000007FB0000-0x000000000804C000-memory.dmp

Filesize
624KB

Download
memory/4668-135-0x0000000000000000-mapping.dmp

Download
memory/4668-136-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4668-138-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4668-139-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download