azorult | 60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220722-en
resource tags

arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system
submitted
30-07-2022 22:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe
Size

848KB
MD5

02bf82c9b9f909a879b5adbc44f2692f
SHA1

20a1941f7a18c0b39c01f677fd27aa92919dc72f
SHA256

60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1
SHA512

2cab260ab1e87204c4a8ee07f6c5e2dff689d074241f390b51bb6590c3b026899c673abfc8dd77c2cd7a2422344ad0bb3471745f5a1b35b2990fc5bbf80b6cdf

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://111.90.150.40/b/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe

description	pid	process	target process
PID 864 set thread context of 1284	864	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe

pid process

864 60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe

pid	process
864	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe

description	pid	process	target process
PID 864 wrote to memory of 1284	864	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe
PID 864 wrote to memory of 1284	864	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe
PID 864 wrote to memory of 1284	864	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe
PID 864 wrote to memory of 1284	864	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe
PID 864 wrote to memory of 1284	864	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe
PID 864 wrote to memory of 1284	864	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe
PID 864 wrote to memory of 1284	864	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe
PID 864 wrote to memory of 1284	864	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe
PID 864 wrote to memory of 1284	864	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe
PID 864 wrote to memory of 1284	864	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe
PID 864 wrote to memory of 1284	864	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe	60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe

C:\Users\Admin\AppData\Local\Temp\60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe
"C:\Users\Admin\AppData\Local\Temp\60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:864
- C:\Users\Admin\AppData\Local\Temp\60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe
  "C:\Users\Admin\AppData\Local\Temp\60e4817d0201b82f7d39b1ac1afaa7c13962d9ba6a74a84bd51eaab9804d62d1.exe"
  2⤵
  PID:1284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/864-138-0x0000000076F40000-0x00000000770E3000-memory.dmp

Filesize
1.6MB

Download
memory/864-139-0x00007FFBD5B90000-0x00007FFBD5D85000-memory.dmp

Filesize
2.0MB

Download
memory/864-141-0x00007FFBD5B90000-0x00007FFBD5D85000-memory.dmp

Filesize
2.0MB

Download
memory/1284-134-0x0000000000000000-mapping.dmp

Download
memory/1284-135-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1284-137-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1284-140-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1284-142-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1284-143-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download