azorult | fa18a501411f545c3d67e178fbd3874162c2c9254a86f8083a325098537b97e1

Analysis

Target

fa18a501411f545c3d67e178fbd3874162c2c9254a86f8083a325098537b97e1.exe
Size

573KB
MD5

f7dd0b6b02df52dc345153fdc30f43cf
SHA1

6e772c7cf95e7cac417407fe8b0a2c67aabc1473
SHA256

fa18a501411f545c3d67e178fbd3874162c2c9254a86f8083a325098537b97e1
SHA512

64e6357d36b811cc014ee6630db2f1695e9af66555d23bcf7531e64eba10349ea1ae9a8c807d95ce4f20a3f9a60f3b64766b4997fb63198cc23068c10aec4a4a

Score

10^/10

Family

azorult

http://worldatdoor.in/linkguy/32/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

fa18a501411f545c3d67e178fbd3874162c2c9254a86f8083a325098537b97e1.exe

description	pid	process	target process
PID 4904 set thread context of 1612	4904	fa18a501411f545c3d67e178fbd3874162c2c9254a86f8083a325098537b97e1.exe	fa18a501411f545c3d67e178fbd3874162c2c9254a86f8083a325098537b97e1.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

fa18a501411f545c3d67e178fbd3874162c2c9254a86f8083a325098537b97e1.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

fa18a501411f545c3d67e178fbd3874162c2c9254a86f8083a325098537b97e1.exe

pid process

4904 fa18a501411f545c3d67e178fbd3874162c2c9254a86f8083a325098537b97e1.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

fa18a501411f545c3d67e178fbd3874162c2c9254a86f8083a325098537b97e1.exe

description	pid	process	target process
PID 4904 wrote to memory of 1612	4904	fa18a501411f545c3d67e178fbd3874162c2c9254a86f8083a325098537b97e1.exe	fa18a501411f545c3d67e178fbd3874162c2c9254a86f8083a325098537b97e1.exe
PID 4904 wrote to memory of 1612	4904	fa18a501411f545c3d67e178fbd3874162c2c9254a86f8083a325098537b97e1.exe	fa18a501411f545c3d67e178fbd3874162c2c9254a86f8083a325098537b97e1.exe
PID 4904 wrote to memory of 1612	4904	fa18a501411f545c3d67e178fbd3874162c2c9254a86f8083a325098537b97e1.exe	fa18a501411f545c3d67e178fbd3874162c2c9254a86f8083a325098537b97e1.exe
PID 4904 wrote to memory of 1612	4904	fa18a501411f545c3d67e178fbd3874162c2c9254a86f8083a325098537b97e1.exe	fa18a501411f545c3d67e178fbd3874162c2c9254a86f8083a325098537b97e1.exe

C:\Users\Admin\AppData\Local\Temp\fa18a501411f545c3d67e178fbd3874162c2c9254a86f8083a325098537b97e1.exe
"C:\Users\Admin\AppData\Local\Temp\fa18a501411f545c3d67e178fbd3874162c2c9254a86f8083a325098537b97e1.exe"
2⤵
PID:1612

memory/1612-131-0x0000000000000000-mapping.dmp

Download
memory/1612-132-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4904-130-0x00000000007E0000-0x00000000007E5000-memory.dmp

Filesize
20KB

Download