azorult | 8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464

Analysis

max time kernel
156s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220722-en
resource tags

arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system
submitted
31-07-2022 07:13

Target

8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe
Size

508KB
MD5

1c03f681904f68cfe208d7212e6548af
SHA1

d4ec4296d5b7c059c515ad9f7c6a92f3b0c70e4b
SHA256

8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464
SHA512

21770733a1fc64dc65abfd5312c5cfb8b61fe4a08e1e064425d60dbcd077dda0ac350dc3aa055ca46f4151f62d8210daf445cc1b5655915cc6135d33bddd10f4

Score

10^/10

Family

azorult

http://changdeacorp.com/filesss/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe

description	pid	process	target process
PID 4952 set thread context of 3484	4952	8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe	8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe

pid process

4952 8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe

pid	process
4952	8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe

description	pid	process	target process
PID 4952 wrote to memory of 3484	4952	8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe	8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe
PID 4952 wrote to memory of 3484	4952	8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe	8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe
PID 4952 wrote to memory of 3484	4952	8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe	8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe

C:\Users\Admin\AppData\Local\Temp\8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe
"C:\Users\Admin\AppData\Local\Temp\8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Users\Admin\AppData\Local\Temp\8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe
  C:\Users\Admin\AppData\Local\Temp\8bff25c1043e2e5a381afa16ba985bc8298af1fda79adcea8bab506f2864b464.exe"
  2⤵
  PID:3484

memory/3484-135-0x0000000000000000-mapping.dmp

Download
memory/3484-138-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3484-143-0x0000000077E30000-0x0000000077FD3000-memory.dmp

Filesize
1.6MB

Download
memory/3484-144-0x0000000077E30000-0x0000000077FD3000-memory.dmp

Filesize
1.6MB

Download
memory/4952-134-0x0000000002A40000-0x0000000002A47000-memory.dmp

Filesize
28KB

Download
memory/4952-136-0x0000000077E30000-0x0000000077FD3000-memory.dmp

Filesize
1.6MB

Download