azorult | 6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3

Analysis

max time kernel
57s
max time network
64s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
30-07-2022 21:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe
Size

288KB
MD5

7f783c47a421f5c915a2a5b26caad712
SHA1

1d2245282d7fe762dac986365649867224f295e2
SHA256

6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3
SHA512

b17b149b185926cad93d5f32eacda0340b57763b2683506ac09233fae1551da05191102c069a6133b844b3b6e64989922117935deeb2b23afcc8fc528ac3e5c8

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://rumorinformation.info/Panel/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe

description	pid	process	target process
PID 2036 set thread context of 1984	2036	6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe	6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe

Drops file in Windows directory 2 IoCs

Processes:

6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe

description	ioc	process
File opened for modification	C:\Windows\win.ini	6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe
File opened for modification	C:\Windows\win.ini	6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe

pid	process
2036	6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe
1984	6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe

description	pid	process	target process
PID 2036 wrote to memory of 1984	2036	6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe	6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe
PID 2036 wrote to memory of 1984	2036	6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe	6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe
PID 2036 wrote to memory of 1984	2036	6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe	6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe
PID 2036 wrote to memory of 1984	2036	6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe	6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe

C:\Users\Admin\AppData\Local\Temp\6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe
"C:\Users\Admin\AppData\Local\Temp\6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe"
1⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Users\Admin\AppData\Local\Temp\6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe
  "C:\Users\Admin\AppData\Local\Temp\6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:1984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win.ini

Filesize
509B

MD5
d2a2412bddba16d60ec63bd9550d933f

SHA1
deb3d3bdc9055f0b4909b31d3048446848fae0e1

SHA256
79ff2254e38192be1626d05bec6c82e10c85e1cf91df7440c4c443380a1e877a

SHA512
8fecada107f72e59e43a689eeb8e2e18fa6134d0941c122025ed5bd00e5eab8114d7125bd289505be75641385a0c3f112d402c693f142c3ddc870d5fa8116e31

Download Submit
memory/1984-73-0x00000000003F0000-0x00000000003F3000-memory.dmp

Filesize
12KB

Download
memory/1984-57-0x0000000000000000-mapping.dmp

Download
memory/1984-63-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/1984-75-0x0000000077670000-0x0000000077746000-memory.dmp

Filesize
856KB

Download
memory/1984-64-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1984-74-0x0000000077480000-0x0000000077629000-memory.dmp

Filesize
1.7MB

Download
memory/2036-62-0x00000000003C0000-0x00000000003C3000-memory.dmp

Filesize
12KB

Download
memory/2036-71-0x0000000077660000-0x00000000777E0000-memory.dmp

Filesize
1.5MB

Download
memory/2036-72-0x0000000077660000-0x00000000777E0000-memory.dmp

Filesize
1.5MB

Download
memory/2036-70-0x0000000077660000-0x00000000777E0000-memory.dmp

Filesize
1.5MB

Download
memory/2036-56-0x0000000075481000-0x0000000075483000-memory.dmp

Filesize
8KB

Download
memory/2036-65-0x0000000077480000-0x0000000077629000-memory.dmp

Filesize
1.7MB

Download
memory/2036-76-0x0000000077660000-0x00000000777E0000-memory.dmp

Filesize
1.5MB

Download
memory/2036-77-0x0000000077660000-0x00000000777E0000-memory.dmp

Filesize
1.5MB

Download