azorult | 61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264

General

Target

61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe
Size

848KB
MD5

76492cf4fc3ae53aea1b6eaacd262a0d
SHA1

0625807598d4b93b6ba296acc9e4d6ed18cea0e1
SHA256

61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264
SHA512

f2305f9b2374e35c805210342e7a6f96bd17845c50166d7113a11b3b9ce81976a09bbcfd11845a0f8dfd3e1f0f9bfc5195cd6983702d746ac97ecd2e34306b6a

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://91.243.80.91/123/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe

description	pid	process	target process
PID 1272 set thread context of 1620	1272	61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe	61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe

pid process

1272 61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe

pid	process
1272	61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe

description	pid	process	target process
PID 1272 wrote to memory of 1620	1272	61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe	61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe
PID 1272 wrote to memory of 1620	1272	61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe	61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe
PID 1272 wrote to memory of 1620	1272	61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe	61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe
PID 1272 wrote to memory of 1620	1272	61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe	61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe
PID 1272 wrote to memory of 1620	1272	61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe	61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe
PID 1272 wrote to memory of 1620	1272	61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe	61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe
PID 1272 wrote to memory of 1620	1272	61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe	61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe
PID 1272 wrote to memory of 1620	1272	61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe	61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe
PID 1272 wrote to memory of 1620	1272	61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe	61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe
PID 1272 wrote to memory of 1620	1272	61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe	61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe
PID 1272 wrote to memory of 1620	1272	61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe	61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe
PID 1272 wrote to memory of 1620	1272	61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe	61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe

C:\Users\Admin\AppData\Local\Temp\61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe
"C:\Users\Admin\AppData\Local\Temp\61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Users\Admin\AppData\Local\Temp\61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe
  "C:\Users\Admin\AppData\Local\Temp\61b1c2c9d05f495415e285de029b7ca8380f29c6ce43d7aae9633ac80bf00264.exe"
  2⤵
  PID:1620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1272-132-0x0000000002390000-0x0000000002396000-memory.dmp

Filesize
24KB

Download
memory/1620-133-0x0000000000000000-mapping.dmp

Download
memory/1620-134-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1620-137-0x000000000041B000-0x000000000041C000-memory.dmp

Filesize
4KB

Download
memory/1620-136-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/1620-138-0x000000000041B000-0x000000000041C000-memory.dmp

Filesize
4KB

Download
memory/1620-139-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1620-140-0x0000000000401000-0x000000000041F000-memory.dmp

Filesize
120KB

Download
memory/1620-141-0x0000000000401000-0x000000000041F000-memory.dmp

Filesize
120KB

Download
memory/1620-142-0x0000000000401000-0x000000000041F000-memory.dmp

Filesize
120KB

Download
memory/1620-143-0x0000000000401000-0x000000000041F000-memory.dmp

Filesize
120KB

Download
memory/1620-144-0x0000000000401000-0x000000000041F000-memory.dmp

Filesize
120KB

Download
memory/1620-145-0x0000000000401000-0x000000000041F000-memory.dmp

Filesize
120KB

Download
memory/1620-146-0x0000000000401000-0x000000000041F000-memory.dmp

Filesize
120KB

Download
memory/1620-147-0x0000000000401000-0x000000000041F000-memory.dmp

Filesize
120KB

Download
memory/1620-148-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1620-149-0x0000000000401000-0x000000000041F000-memory.dmp

Filesize
120KB

Download
memory/1620-150-0x0000000000401000-0x000000000041F000-memory.dmp

Filesize
120KB

Download
memory/1620-151-0x0000000000401000-0x000000000041F000-memory.dmp

Filesize
120KB

Download
memory/1620-152-0x0000000000401000-0x000000000041F000-memory.dmp

Filesize
120KB

Download
memory/1620-153-0x0000000000401000-0x000000000041F000-memory.dmp

Filesize
120KB

Download
memory/1620-154-0x0000000000401000-0x000000000041F000-memory.dmp

Filesize
120KB

Download
memory/1620-155-0x0000000000401000-0x000000000041F000-memory.dmp

Filesize
120KB

Download
memory/1620-156-0x0000000000401000-0x000000000041F000-memory.dmp

Filesize
120KB

Download
memory/1620-157-0x0000000000401000-0x000000000041F000-memory.dmp

Filesize
120KB

Download
memory/1620-158-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing