azorult | 8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464

Analysis

max time kernel
84s
max time network
89s
platform
windows7_x64
resource
win7-20220718-en
resource tags

arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
submitted
31-07-2022 07:13

Target

8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe
Size

508KB
MD5

1c03f681904f68cfe208d7212e6548af
SHA1

d4ec4296d5b7c059c515ad9f7c6a92f3b0c70e4b
SHA256

8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464
SHA512

21770733a1fc64dc65abfd5312c5cfb8b61fe4a08e1e064425d60dbcd077dda0ac350dc3aa055ca46f4151f62d8210daf445cc1b5655915cc6135d33bddd10f4

Score

10^/10

Family

azorult

http://changdeacorp.com/filesss/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe

description	pid	process	target process
PID 1360 set thread context of 1832	1360	8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe	8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe

pid process

1360 8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe

pid process

1832 8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe

pid	process
1360	8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe

pid	process
1832	8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe

description	pid	process	target process
PID 1360 wrote to memory of 1832	1360	8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe	8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe
PID 1360 wrote to memory of 1832	1360	8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe	8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe
PID 1360 wrote to memory of 1832	1360	8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe	8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe
PID 1360 wrote to memory of 1832	1360	8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe	8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe

C:\Users\Admin\AppData\Local\Temp\8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe
"C:\Users\Admin\AppData\Local\Temp\8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Users\Admin\AppData\Local\Temp\8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe
  C:\Users\Admin\AppData\Local\Temp\8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe"
  2⤵
  - Suspicious use of UnmapMainImage
  PID:1832

memory/1360-56-0x0000000000370000-0x0000000000377000-memory.dmp

Filesize
28KB

Download
memory/1360-57-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/1360-59-0x0000000077270000-0x00000000773F0000-memory.dmp

Filesize
1.5MB

Download
memory/1832-58-0x0000000000472EBF-mapping.dmp

Download
memory/1832-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1832-67-0x0000000077270000-0x00000000773F0000-memory.dmp

Filesize
1.5MB

Download
memory/1832-68-0x0000000077270000-0x00000000773F0000-memory.dmp

Filesize
1.5MB

Download