azorult | 1d515fe425b7bbdaeb89dacda88b6597a80c5de85eb01f1534c1d1f139390327

Analysis

Target
1d515fe425b7bbdaeb89dacda88b6597a80c5de85eb01f1534c1d1f139390327.exe
Size 962KB
Sample220607-ek259sgbc7
SHA256 1d515fe425b7bbdaeb89dacda88b6597a80c5de85eb01f1534c1d1f139390327
MD5 c2c9a7b450c7e1386f6d98fe7762033b
SHA1 b7d1e7109456c48453e7e1d2368ab447ba742269
SHA512 396c0e65a46dcff6d76c487ae50a32e1fce6cd6bd188b3a09bfe5e1d2baa6446ecb55893a0ddd41945ff5267b3aa74867d36bd98def018b9f885c975ed1f426f
MD5 SHA1 SHA512

Score

10^/10

Family

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2388 set thread context of 2920	2388	1d515fe425b7bbdaeb89dacda88b6597a80c5de85eb01f1534c1d1f139390327.exe	86

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2388	1d515fe425b7bbdaeb89dacda88b6597a80c5de85eb01f1534c1d1f139390327.exe
2388	1d515fe425b7bbdaeb89dacda88b6597a80c5de85eb01f1534c1d1f139390327.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2388	1d515fe425b7bbdaeb89dacda88b6597a80c5de85eb01f1534c1d1f139390327.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2920	2388	1d515fe425b7bbdaeb89dacda88b6597a80c5de85eb01f1534c1d1f139390327.exe	86
PID 2388 wrote to memory of 2920	2388	1d515fe425b7bbdaeb89dacda88b6597a80c5de85eb01f1534c1d1f139390327.exe	86
PID 2388 wrote to memory of 2920	2388	1d515fe425b7bbdaeb89dacda88b6597a80c5de85eb01f1534c1d1f139390327.exe	86
PID 2388 wrote to memory of 2920	2388	1d515fe425b7bbdaeb89dacda88b6597a80c5de85eb01f1534c1d1f139390327.exe	86
PID 2388 wrote to memory of 2920	2388	1d515fe425b7bbdaeb89dacda88b6597a80c5de85eb01f1534c1d1f139390327.exe	86
PID 2388 wrote to memory of 2920	2388	1d515fe425b7bbdaeb89dacda88b6597a80c5de85eb01f1534c1d1f139390327.exe	86
PID 2388 wrote to memory of 2920	2388	1d515fe425b7bbdaeb89dacda88b6597a80c5de85eb01f1534c1d1f139390327.exe	86
PID 2388 wrote to memory of 2920	2388	1d515fe425b7bbdaeb89dacda88b6597a80c5de85eb01f1534c1d1f139390327.exe	86
PID 2388 wrote to memory of 2920	2388	1d515fe425b7bbdaeb89dacda88b6597a80c5de85eb01f1534c1d1f139390327.exe	86

C:\Users\Admin\AppData\Local\Temp\1d515fe425b7bbdaeb89dacda88b6597a80c5de85eb01f1534c1d1f139390327.exe
"C:\Users\Admin\AppData\Local\Temp\1d515fe425b7bbdaeb89dacda88b6597a80c5de85eb01f1534c1d1f139390327.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Users\Admin\AppData\Local\Temp\1d515fe425b7bbdaeb89dacda88b6597a80c5de85eb01f1534c1d1f139390327.exe
  "C:\Users\Admin\AppData\Local\Temp\1d515fe425b7bbdaeb89dacda88b6597a80c5de85eb01f1534c1d1f139390327.exe"
  2⤵
  PID:2920

memory/2388-130-0x0000000074AC0000-0x0000000075071000-memory.dmp

Download

memory/2388-131-0x0000000074AC0000-0x0000000075071000-memory.dmp

Download

memory/2388-137-0x0000000074AC0000-0x0000000075071000-memory.dmp

Download

memory/2920-133-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2920-135-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2920-136-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2920-138-0x0000000000400000-0x0000000000420000-memory.dmp

Download