azorult | 1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8

General

Target
1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8.exe
Size 491KB
Sample220607-ez3eksghb9
SHA256 1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8
MD5 76c487459d38c2801be5fdba0587912c
SHA1 428b648e9506dd3a2dc644797756ed4ea39a0338
SHA512 85ede1f60c4ceac485e55176b7ea7bf3cd9bfe95e8745e97cf8825e3c7efcf70c32b2af85d4d96221919a0e2c8a5dd44009696707d5454a8f0ff5ef52db96808
MD5 SHA1 SHA512

Score

10^/10

azorult infostealer suricata trojan upx

Malware Config

Extracted

Family

azorult

C2

https://romanone.com/wp-content/okoye/32/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M14
suricata: ET MALWARE Win32/AZORult V3.2 Client Checkin M14
suricata

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/400-130-0x00000000004B0000-0x00000000005A4000-memory.dmp	upx
behavioral2/memory/400-131-0x00000000004B0000-0x00000000005A4000-memory.dmp	upx
behavioral2/memory/400-135-0x00000000004B0000-0x00000000005A4000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 400 set thread context of 4908	400	1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8.exe	78

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
400	1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8.exe
400	1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8.exe
400	1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8.exe
400	1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8.exe
400	1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8.exe
400	1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8.exe
400	1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8.exe
400	1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
400	1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8.exe
400	1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8.exe
400	1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 4888	400	1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8.exe	76
PID 400 wrote to memory of 4888	400	1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8.exe	76
PID 400 wrote to memory of 4888	400	1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8.exe	76
PID 400 wrote to memory of 960	400	1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8.exe	77
PID 400 wrote to memory of 960	400	1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8.exe	77
PID 400 wrote to memory of 960	400	1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8.exe	77
PID 400 wrote to memory of 4908	400	1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8.exe	78
PID 400 wrote to memory of 4908	400	1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8.exe	78
PID 400 wrote to memory of 4908	400	1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8.exe	78
PID 400 wrote to memory of 4908	400	1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8.exe	78

C:\Users\Admin\AppData\Local\Temp\1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8.exe
"C:\Users\Admin\AppData\Local\Temp\1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:400
- C:\Users\Admin\AppData\Local\Temp\1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8.exe
  "C:\Users\Admin\AppData\Local\Temp\1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8.exe"
  2⤵
  PID:4888
- C:\Users\Admin\AppData\Local\Temp\1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8.exe
  "C:\Users\Admin\AppData\Local\Temp\1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8.exe"
  2⤵
  PID:960
- C:\Users\Admin\AppData\Local\Temp\1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8.exe
  "C:\Users\Admin\AppData\Local\Temp\1d35e181a9d81056b9d7ccc05d257082c5aa6d1fdd275ea64c94ef2425e1b4d8.exe"
  2⤵
  PID:4908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/400-130-0x00000000004B0000-0x00000000005A4000-memory.dmp

Download

memory/400-131-0x00000000004B0000-0x00000000005A4000-memory.dmp

Download

memory/400-135-0x00000000004B0000-0x00000000005A4000-memory.dmp

Download

memory/4908-136-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4908-137-0x0000000000400000-0x0000000000420000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads