Malware Analysis Report

2025-08-05 14:30

Sample ID 220523-b8qklabdg9
Target 6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe
SHA256 6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327
Tags
azorult infostealer suricata trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327

Threat Level: Known bad

The file 6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe was found to be: Known bad.

Malicious Activity Summary

azorult infostealer suricata trojan

Azorult

suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M6

suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M13

Suspicious use of SetThreadContext

Suspicious use of WriteProcessMemory

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2022-05-23 01:49

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-05-23 01:49

Reported

2022-05-23 01:57

Platform

win7-20220414-en

Max time kernel

138s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe"

Signatures

Azorult

trojan infostealer azorult

suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M6

suricata

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1688 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe
PID 1688 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe
PID 1688 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe
PID 1688 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe
PID 1688 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe
PID 1688 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe
PID 1688 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe
PID 1688 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe
PID 1688 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe
PID 1688 wrote to memory of 1892 N/A C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe

Processes

C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe

"C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe"

C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe

"C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe"

Network

Country Destination Domain Proto
NL 85.202.169.121:80 85.202.169.121 tcp

Files

memory/1688-54-0x00000000013C0000-0x0000000001478000-memory.dmp

memory/1688-55-0x0000000076391000-0x0000000076393000-memory.dmp

memory/1688-56-0x0000000000630000-0x000000000064A000-memory.dmp

memory/1688-57-0x00000000054B0000-0x0000000005552000-memory.dmp

memory/1688-58-0x0000000000A40000-0x0000000000A62000-memory.dmp

memory/1892-59-0x0000000000400000-0x0000000000420000-memory.dmp

memory/1892-60-0x0000000000400000-0x0000000000420000-memory.dmp

memory/1892-62-0x0000000000400000-0x0000000000420000-memory.dmp

memory/1892-63-0x0000000000400000-0x0000000000420000-memory.dmp

memory/1892-64-0x0000000000400000-0x0000000000420000-memory.dmp

memory/1892-66-0x0000000000400000-0x0000000000420000-memory.dmp

memory/1892-67-0x000000000041A684-mapping.dmp

memory/1892-69-0x0000000000400000-0x0000000000420000-memory.dmp

memory/1892-71-0x0000000000400000-0x0000000000420000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-05-23 01:49

Reported

2022-05-23 01:58

Platform

win10v2004-20220414-en

Max time kernel

111s

Max time network

180s

Command Line

"C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe"

Signatures

Azorult

trojan infostealer azorult

suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M13

suricata

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4416 wrote to memory of 4188 N/A C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe
PID 4416 wrote to memory of 4188 N/A C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe
PID 4416 wrote to memory of 4188 N/A C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe
PID 4416 wrote to memory of 4188 N/A C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe
PID 4416 wrote to memory of 4188 N/A C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe
PID 4416 wrote to memory of 4188 N/A C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe
PID 4416 wrote to memory of 4188 N/A C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe
PID 4416 wrote to memory of 4188 N/A C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe
PID 4416 wrote to memory of 4188 N/A C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe

Processes

C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe

"C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe"

C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe

"C:\Users\Admin\AppData\Local\Temp\6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327.exe"

Network

Country Destination Domain Proto
BE 67.27.153.254:80 tcp
BE 67.27.153.254:80 tcp
NL 85.202.169.121:80 85.202.169.121 tcp

Files

memory/4416-130-0x0000000000170000-0x0000000000228000-memory.dmp

memory/4416-131-0x00000000051C0000-0x0000000005764000-memory.dmp

memory/4416-132-0x0000000004C10000-0x0000000004CA2000-memory.dmp

memory/4416-133-0x0000000004BD0000-0x0000000004BDA000-memory.dmp

memory/4416-134-0x0000000008940000-0x00000000089DC000-memory.dmp

memory/4188-135-0x0000000000000000-mapping.dmp

memory/4188-136-0x0000000000400000-0x0000000000420000-memory.dmp

memory/4188-138-0x0000000000400000-0x0000000000420000-memory.dmp

memory/4188-139-0x0000000000400000-0x0000000000420000-memory.dmp