azorult | 6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3

Analysis

max time kernel
133s
max time network
245s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
30-07-2022 21:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe
Size

288KB
MD5

7f783c47a421f5c915a2a5b26caad712
SHA1

1d2245282d7fe762dac986365649867224f295e2
SHA256

6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3
SHA512

b17b149b185926cad93d5f32eacda0340b57763b2683506ac09233fae1551da05191102c069a6133b844b3b6e64989922117935deeb2b23afcc8fc528ac3e5c8

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://rumorinformation.info/Panel/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Drops file in Windows directory 2 IoCs

Processes:

6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe

description	ioc	process
File opened for modification	C:\Windows\win.ini	6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe
File opened for modification	C:\Windows\win.ini	6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe

pid	process
2640	6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe
4616	6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe

description	pid	process	target process
PID 2640 wrote to memory of 4616	2640	6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe	6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe
PID 2640 wrote to memory of 4616	2640	6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe	6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe
PID 2640 wrote to memory of 4616	2640	6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe	6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe

C:\Users\Admin\AppData\Local\Temp\6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe
"C:\Users\Admin\AppData\Local\Temp\6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Users\Admin\AppData\Local\Temp\6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe
  "C:\Users\Admin\AppData\Local\Temp\6168d6bf5dd7061cd84af03127e27bcfbd9dba2093d085b598ab34cf023bb9d3.exe"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:4616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\win.ini

Filesize
123B

MD5
6bf517432f65eb7f0d18d574bf14124c

SHA1
5b9f37c1dd1318ebbec3bd2f07c109eb9d22c727

SHA256
6e2b70dfccabf3cc651545676a3a566c9cfae03f15f772886646abce1da35b46

SHA512
7b0cb8c20034585ec8bf4b45eda5eda5993a56e24931a7426dc5a9f081ec1f82545f3e26a48a4df885c8691fc6e8026d0808aebe3cc3358ba85ddca08ac4cb06

Download Submit
memory/2640-137-0x00007FF93FBB0000-0x00007FF93FDA5000-memory.dmp

Filesize
2.0MB

Download
memory/2640-132-0x00000000020B0000-0x00000000020B3000-memory.dmp

Filesize
12KB

Download
memory/2640-140-0x0000000077850000-0x00000000779F3000-memory.dmp

Filesize
1.6MB

Download
memory/2640-139-0x00000000020B0000-0x00000000020B3000-memory.dmp

Filesize
12KB

Download
memory/4616-146-0x0000000002090000-0x0000000002093000-memory.dmp

Filesize
12KB

Download
memory/4616-133-0x0000000000000000-mapping.dmp

Download
memory/4616-138-0x0000000000400000-0x000000000044D000-memory.dmp

Filesize
308KB

Download
memory/4616-141-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4616-147-0x00007FF93FBB0000-0x00007FF93FDA5000-memory.dmp

Filesize
2.0MB

Download
memory/4616-148-0x0000000077850000-0x00000000779F3000-memory.dmp

Filesize
1.6MB

Download
memory/4616-149-0x0000000002C30000-0x0000000002C57000-memory.dmp

Filesize
156KB

Download
memory/4616-150-0x0000000002C31000-0x0000000002C4E000-memory.dmp

Filesize
116KB

Download
memory/4616-151-0x0000000077850000-0x00000000779F3000-memory.dmp

Filesize
1.6MB

Download
memory/4616-152-0x0000000077850000-0x00000000779F3000-memory.dmp

Filesize
1.6MB

Download