azorult | 3bdcfffd58d9c5765825f4ef7d42d75b9d2aec412f0b35dbd0298a51474ce0ec

General

Target

3bdcfffd58d9c5765825f4ef7d42d75b9d2aec412f0b35dbd0298a51474ce0ec.exe
Size

582KB
MD5

38d328dd86ebad6931208bc20280fcda
SHA1

89a9285ea26ff51212e7cbb68cbccfd6c262c296
SHA256

3bdcfffd58d9c5765825f4ef7d42d75b9d2aec412f0b35dbd0298a51474ce0ec
SHA512

5b2324b74cec5bf6c2632f453e7dc397a7fcd7f1977f17dd2e085a047f3aed0b1caecc40cbf1b3e0b009b1ec75aa2b2d7872fe91bff574af5b3e4df43f868d94

Score

10^/10

Family

azorult

C2

http://projectkanor.bit/az/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Unexpected DNS network traffic destination 7 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

Suspicious use of SetThreadContext 1 IoCs

Processes:

3bdcfffd58d9c5765825f4ef7d42d75b9d2aec412f0b35dbd0298a51474ce0ec.exe

description	pid	process	target process
PID 2028 set thread context of 956	2028	3bdcfffd58d9c5765825f4ef7d42d75b9d2aec412f0b35dbd0298a51474ce0ec.exe	3bdcfffd58d9c5765825f4ef7d42d75b9d2aec412f0b35dbd0298a51474ce0ec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

3bdcfffd58d9c5765825f4ef7d42d75b9d2aec412f0b35dbd0298a51474ce0ec.exe

pid process

2028 3bdcfffd58d9c5765825f4ef7d42d75b9d2aec412f0b35dbd0298a51474ce0ec.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

3bdcfffd58d9c5765825f4ef7d42d75b9d2aec412f0b35dbd0298a51474ce0ec.exe

pid process

956 3bdcfffd58d9c5765825f4ef7d42d75b9d2aec412f0b35dbd0298a51474ce0ec.exe

pid	process
2028	3bdcfffd58d9c5765825f4ef7d42d75b9d2aec412f0b35dbd0298a51474ce0ec.exe

pid	process
956	3bdcfffd58d9c5765825f4ef7d42d75b9d2aec412f0b35dbd0298a51474ce0ec.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3bdcfffd58d9c5765825f4ef7d42d75b9d2aec412f0b35dbd0298a51474ce0ec.exe

description	pid	process	target process
PID 2028 wrote to memory of 956	2028	3bdcfffd58d9c5765825f4ef7d42d75b9d2aec412f0b35dbd0298a51474ce0ec.exe	3bdcfffd58d9c5765825f4ef7d42d75b9d2aec412f0b35dbd0298a51474ce0ec.exe
PID 2028 wrote to memory of 956	2028	3bdcfffd58d9c5765825f4ef7d42d75b9d2aec412f0b35dbd0298a51474ce0ec.exe	3bdcfffd58d9c5765825f4ef7d42d75b9d2aec412f0b35dbd0298a51474ce0ec.exe
PID 2028 wrote to memory of 956	2028	3bdcfffd58d9c5765825f4ef7d42d75b9d2aec412f0b35dbd0298a51474ce0ec.exe	3bdcfffd58d9c5765825f4ef7d42d75b9d2aec412f0b35dbd0298a51474ce0ec.exe
PID 2028 wrote to memory of 956	2028	3bdcfffd58d9c5765825f4ef7d42d75b9d2aec412f0b35dbd0298a51474ce0ec.exe	3bdcfffd58d9c5765825f4ef7d42d75b9d2aec412f0b35dbd0298a51474ce0ec.exe

C:\Users\Admin\AppData\Local\Temp\3bdcfffd58d9c5765825f4ef7d42d75b9d2aec412f0b35dbd0298a51474ce0ec.exe
C:\Users\Admin\AppData\Local\Temp\3bdcfffd58d9c5765825f4ef7d42d75b9d2aec412f0b35dbd0298a51474ce0ec.exe"
2⤵
- Suspicious use of UnmapMainImage
PID:956

memory/956-58-0x0000000000475F72-mapping.dmp

Download
memory/956-62-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/956-75-0x0000000077A20000-0x0000000077BA0000-memory.dmp

Filesize
1.5MB

Download
memory/956-76-0x0000000077A20000-0x0000000077BA0000-memory.dmp

Filesize
1.5MB

Download
memory/956-77-0x0000000000400000-0x000000000048E000-memory.dmp

Filesize
568KB

Download
memory/2028-56-0x0000000000250000-0x0000000000257000-memory.dmp

Filesize
28KB

Download
memory/2028-57-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/2028-59-0x0000000077A20000-0x0000000077BA0000-memory.dmp

Filesize
1.5MB

Download