azorult | 6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d

General

Target

6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
Size

767KB
MD5

e559254e91867aace2c523eb0077f49c
SHA1

b23c0e718fc7f595cefcafa8d7d4ebf9c7fb53ac
SHA256

6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d
SHA512

f4a5a00e330832a523957128064bf7c5233fde389284f65bcc7efb6cffd672fb97d4fe6981f81b728adc80150719efdb67856e48accd5f5d4350b5e9aa02695d

Score

10^/10

azorult infostealer trojan

Malware Config

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description	ioc
Destination IP	130.255.78.223
Destination IP	173.212.234.232
Destination IP	151.80.147.153
Destination IP	91.217.137.44
Destination IP	80.233.248.109

Suspicious use of SetThreadContext 1 IoCs

Processes:

6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe

description	pid	process	target process
PID 1076 set thread context of 1996	1076	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe

description pid process

Token: SeDebugPrivilege 1076 6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe

description	pid	process
Token: SeDebugPrivilege	1076	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe

C:\Users\Admin\AppData\Local\Temp\6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
"C:\Users\Admin\AppData\Local\Temp\6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Users\Admin\AppData\Local\Temp\6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
  "C:\Users\Admin\AppData\Local\Temp\6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe"
  2⤵
  PID:1996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1076-54-0x0000000000070000-0x0000000000132000-memory.dmp

Filesize
776KB

Download
memory/1076-55-0x00000000006C0000-0x00000000006E0000-memory.dmp

Filesize
128KB

Download
memory/1076-56-0x0000000076921000-0x0000000076923000-memory.dmp

Filesize
8KB

Download
memory/1996-58-0x0000000000427000-mapping.dmp

Download
memory/1996-62-0x0000000000150000-0x0000000000178000-memory.dmp

Filesize
160KB

Download
memory/1996-60-0x0000000000150000-0x0000000000178000-memory.dmp

Filesize
160KB

Download
memory/1996-59-0x0000000000150000-0x0000000000178000-memory.dmp

Filesize
160KB

Download
memory/1996-64-0x0000000000150000-0x0000000000178000-memory.dmp

Filesize
160KB

Download
memory/1996-65-0x0000000000150000-0x0000000000178000-memory.dmp

Filesize
160KB

Download

description	pid	process	target process
PID 1076 wrote to memory of 1996	1076	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
PID 1076 wrote to memory of 1996	1076	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
PID 1076 wrote to memory of 1996	1076	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
PID 1076 wrote to memory of 1996	1076	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
PID 1076 wrote to memory of 1996	1076	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
PID 1076 wrote to memory of 1996	1076	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
PID 1076 wrote to memory of 1996	1076	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
PID 1076 wrote to memory of 1996	1076	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
PID 1076 wrote to memory of 1996	1076	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
PID 1076 wrote to memory of 1996	1076	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
PID 1076 wrote to memory of 1996	1076	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
PID 1076 wrote to memory of 1996	1076	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
PID 1076 wrote to memory of 1996	1076	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
PID 1076 wrote to memory of 1996	1076	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
PID 1076 wrote to memory of 1996	1076	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
PID 1076 wrote to memory of 1996	1076	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
PID 1076 wrote to memory of 1996	1076	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
PID 1076 wrote to memory of 1996	1076	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads