azorult | 69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a

General

Target

69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe
Size

989KB
MD5

06903b77d619dd25dbf161663feaa1fb
SHA1

d37d0d9278fda5a7e989b1aeb384479b840ad96a
SHA256

69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a
SHA512

ac883ba67d5ac423922265f1f480e65a8dbb818f0efa36c2544f18c7c36e000eefa86a9dc7c950c02dc06aded44c12ed41ca72eaa99f4dc7d9d4fd53533faf2e

Score

10^/10

azorult infostealer suricata trojan

Malware Config

Extracted

Family

azorult

C2

http://62.197.136.186/ugonna/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M4
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M4
suricata

Suspicious use of SetThreadContext 1 IoCs

Processes:

69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe

description	pid	process	target process
PID 2044 set thread context of 1644	2044	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

276 1644 WerFault.exe 69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe

pid	pid_target	process	target process
276	1644	WerFault.exe	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe

description	pid	process	target process
PID 2044 wrote to memory of 1644	2044	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe
PID 2044 wrote to memory of 1644	2044	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe
PID 2044 wrote to memory of 1644	2044	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe
PID 2044 wrote to memory of 1644	2044	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe
PID 2044 wrote to memory of 1644	2044	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe
PID 2044 wrote to memory of 1644	2044	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe
PID 2044 wrote to memory of 1644	2044	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe
PID 2044 wrote to memory of 1644	2044	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe
PID 2044 wrote to memory of 1644	2044	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe
PID 2044 wrote to memory of 1644	2044	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe
PID 1644 wrote to memory of 276	1644	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe	WerFault.exe
PID 1644 wrote to memory of 276	1644	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe	WerFault.exe
PID 1644 wrote to memory of 276	1644	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe	WerFault.exe
PID 1644 wrote to memory of 276	1644	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe
"C:\Users\Admin\AppData\Local\Temp\69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2044

C:\Users\Admin\AppData\Local\Temp\69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe
"C:\Users\Admin\AppData\Local\Temp\69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 752
3⤵
- Program crash
PID:276

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/276-72-0x0000000000000000-mapping.dmp

Download
memory/1644-64-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1644-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1644-71-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1644-69-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1644-59-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1644-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1644-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1644-67-0x000000000041A684-mapping.dmp

Download
memory/1644-66-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2044-54-0x0000000000B00000-0x0000000000BFE000-memory.dmp

Filesize
1016KB

Download
memory/2044-56-0x0000000000450000-0x000000000046A000-memory.dmp

Filesize
104KB

Download
memory/2044-58-0x0000000000780000-0x00000000007A2000-memory.dmp

Filesize
136KB

Download
memory/2044-57-0x00000000080F0000-0x00000000081DA000-memory.dmp

Filesize
936KB

Download
memory/2044-55-0x0000000075441000-0x0000000075443000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing