azorult | 347f567cb5c6b3dca3f5efb98af1e19acead36394eb2c7288fc9672f8323b089

Analysis

max time kernel
90s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
22/05/2022, 13:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
347f567cb5c6b3dca3f5efb98af1e19acead36394eb2c7288fc9672f8323b089.exe
Size 1.1MB
Sample220522-q4dskaadc4
SHA256 347f567cb5c6b3dca3f5efb98af1e19acead36394eb2c7288fc9672f8323b089
MD5 733bbc6a2e675cd0b9a16f292145773e
SHA1 40646255b358627cfc64e0bac2826909e13c4295
SHA512 9d4f8c2f69e22e50ee4ae0f1ac7ba85a18395f3846f75f9a06f06deceda3d68ecef7bb70e1ae48f420f09ab31cc2a3dc1518c34a95f5b46d7e4082316e81fdf9
MD5 SHA1 SHA512

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://bl1we4t.xyz/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2520 set thread context of 4460	2520	347f567cb5c6b3dca3f5efb98af1e19acead36394eb2c7288fc9672f8323b089.exe	88

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 4460	2520	347f567cb5c6b3dca3f5efb98af1e19acead36394eb2c7288fc9672f8323b089.exe	88
PID 2520 wrote to memory of 4460	2520	347f567cb5c6b3dca3f5efb98af1e19acead36394eb2c7288fc9672f8323b089.exe	88
PID 2520 wrote to memory of 4460	2520	347f567cb5c6b3dca3f5efb98af1e19acead36394eb2c7288fc9672f8323b089.exe	88
PID 2520 wrote to memory of 4460	2520	347f567cb5c6b3dca3f5efb98af1e19acead36394eb2c7288fc9672f8323b089.exe	88
PID 2520 wrote to memory of 4460	2520	347f567cb5c6b3dca3f5efb98af1e19acead36394eb2c7288fc9672f8323b089.exe	88
PID 2520 wrote to memory of 4460	2520	347f567cb5c6b3dca3f5efb98af1e19acead36394eb2c7288fc9672f8323b089.exe	88
PID 2520 wrote to memory of 4460	2520	347f567cb5c6b3dca3f5efb98af1e19acead36394eb2c7288fc9672f8323b089.exe	88
PID 2520 wrote to memory of 4460	2520	347f567cb5c6b3dca3f5efb98af1e19acead36394eb2c7288fc9672f8323b089.exe	88
PID 2520 wrote to memory of 4460	2520	347f567cb5c6b3dca3f5efb98af1e19acead36394eb2c7288fc9672f8323b089.exe	88

C:\Users\Admin\AppData\Local\Temp\347f567cb5c6b3dca3f5efb98af1e19acead36394eb2c7288fc9672f8323b089.exe
"C:\Users\Admin\AppData\Local\Temp\347f567cb5c6b3dca3f5efb98af1e19acead36394eb2c7288fc9672f8323b089.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Users\Admin\AppData\Local\Temp\347f567cb5c6b3dca3f5efb98af1e19acead36394eb2c7288fc9672f8323b089.exe
  "C:\Users\Admin\AppData\Local\Temp\347f567cb5c6b3dca3f5efb98af1e19acead36394eb2c7288fc9672f8323b089.exe"
  2⤵
  PID:4460

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2520-130-0x0000000000B00000-0x0000000000C20000-memory.dmp

Download

memory/2520-131-0x0000000005B00000-0x00000000060A4000-memory.dmp

Download

memory/2520-132-0x00000000055F0000-0x0000000005682000-memory.dmp

Download

memory/2520-133-0x00000000055D0000-0x00000000055DA000-memory.dmp

Download

memory/2520-134-0x0000000009130000-0x00000000091CC000-memory.dmp

Download

memory/4460-136-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4460-138-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4460-139-0x0000000000400000-0x0000000000420000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads