azorult | 69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a

General

Target

69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe
Size

989KB
MD5

06903b77d619dd25dbf161663feaa1fb
SHA1

d37d0d9278fda5a7e989b1aeb384479b840ad96a
SHA256

69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a
SHA512

ac883ba67d5ac423922265f1f480e65a8dbb818f0efa36c2544f18c7c36e000eefa86a9dc7c950c02dc06aded44c12ed41ca72eaa99f4dc7d9d4fd53533faf2e

Score

10^/10

azorult infostealer suricata trojan

Malware Config

Extracted

Family

azorult

C2

http://62.197.136.186/ugonna/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M15
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M15
suricata

Suspicious use of SetThreadContext 1 IoCs

Processes:

69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe

description	pid	process	target process
PID 3480 set thread context of 3872	3480	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2668 3872 WerFault.exe 69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe

pid	pid_target	process	target process
2668	3872	WerFault.exe	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe

description	pid	process	target process
PID 3480 wrote to memory of 3872	3480	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe
PID 3480 wrote to memory of 3872	3480	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe
PID 3480 wrote to memory of 3872	3480	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe
PID 3480 wrote to memory of 3872	3480	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe
PID 3480 wrote to memory of 3872	3480	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe
PID 3480 wrote to memory of 3872	3480	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe
PID 3480 wrote to memory of 3872	3480	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe
PID 3480 wrote to memory of 3872	3480	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe
PID 3480 wrote to memory of 3872	3480	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe	69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe

C:\Users\Admin\AppData\Local\Temp\69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe
"C:\Users\Admin\AppData\Local\Temp\69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3480

C:\Users\Admin\AppData\Local\Temp\69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe
"C:\Users\Admin\AppData\Local\Temp\69d0885e1490db820cfa69e85ee79f0fa96375c65b32606c3fa2a6edfe19cf1a.exe"
2⤵
PID:3872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 1212
3⤵
- Program crash
PID:2668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3872 -ip 3872
1⤵
PID:3016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3480-130-0x0000000000920000-0x0000000000A1E000-memory.dmp

Filesize
1016KB

Download
memory/3480-131-0x00000000059C0000-0x0000000005F64000-memory.dmp

Filesize
5.6MB

Download
memory/3480-132-0x0000000005410000-0x00000000054A2000-memory.dmp

Filesize
584KB

Download
memory/3480-133-0x00000000053C0000-0x00000000053CA000-memory.dmp

Filesize
40KB

Download
memory/3480-134-0x0000000008FB0000-0x000000000904C000-memory.dmp

Filesize
624KB

Download
memory/3872-135-0x0000000000000000-mapping.dmp

Download
memory/3872-136-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3872-138-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3872-139-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing