azorult | 60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1

Analysis

max time kernel
79s
max time network
74s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
30-07-2022 22:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe
Size

848KB
MD5

02bf82c9b9f909a879b5adbc44f2692f
SHA1

20a1941f7a18c0b39c01f677fd27aa92919dc72f
SHA256

60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1
SHA512

2cab260ab1e87204c4a8ee07f6c5e2dff689d074241f390b51bb6590c3b026899c673abfc8dd77c2cd7a2422344ad0bb3471745f5a1b35b2990fc5bbf80b6cdf

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://111.90.150.40/b/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe

description	pid	process	target process
PID 1032 set thread context of 2020	1032	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe

pid process

1032 60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe

pid	process
1032	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe

description	pid	process	target process
PID 1032 wrote to memory of 2020	1032	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe
PID 1032 wrote to memory of 2020	1032	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe
PID 1032 wrote to memory of 2020	1032	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe
PID 1032 wrote to memory of 2020	1032	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe
PID 1032 wrote to memory of 2020	1032	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe
PID 1032 wrote to memory of 2020	1032	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe
PID 1032 wrote to memory of 2020	1032	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe
PID 1032 wrote to memory of 2020	1032	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe
PID 1032 wrote to memory of 2020	1032	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe
PID 1032 wrote to memory of 2020	1032	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe
PID 1032 wrote to memory of 2020	1032	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe
PID 1032 wrote to memory of 2020	1032	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe

C:\Users\Admin\AppData\Local\Temp\60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe
"C:\Users\Admin\AppData\Local\Temp\60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Users\Admin\AppData\Local\Temp\60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe
  "C:\Users\Admin\AppData\Local\Temp\60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe"
  2⤵
  PID:2020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1032-56-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Filesize
8KB

Download
memory/1032-60-0x0000000077AC0000-0x0000000077C69000-memory.dmp

Filesize
1.7MB

Download
memory/1032-62-0x0000000077CA0000-0x0000000077E20000-memory.dmp

Filesize
1.5MB

Download
memory/2020-58-0x000000000041A1F8-mapping.dmp

Download
memory/2020-57-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2020-61-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2020-64-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2020-65-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download