azorult | 6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d

General

Target

6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
Size

767KB
MD5

e559254e91867aace2c523eb0077f49c
SHA1

b23c0e718fc7f595cefcafa8d7d4ebf9c7fb53ac
SHA256

6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d
SHA512

f4a5a00e330832a523957128064bf7c5233fde389284f65bcc7efb6cffd672fb97d4fe6981f81b728adc80150719efdb67856e48accd5f5d4350b5e9aa02695d

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://projectkanor.bit/az/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Unexpected DNS network traffic destination 13 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description	ioc
Destination IP	173.212.234.232
Destination IP	91.217.137.44
Destination IP	173.249.7.187
Destination IP	50.3.82.215
Destination IP	107.172.42.186
Destination IP	151.80.147.153
Destination IP	46.101.70.183
Destination IP	80.233.248.109
Destination IP	94.247.43.254
Destination IP	130.255.78.223
Destination IP	5.45.97.127
Destination IP	128.52.130.209
Destination IP	82.141.39.32

Suspicious use of SetThreadContext 1 IoCs

Processes:

6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe

description	pid	process	target process
PID 2760 set thread context of 692	2760	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe

description pid process

Token: SeDebugPrivilege 2760 6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe

description	pid	process
Token: SeDebugPrivilege	2760	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe

C:\Users\Admin\AppData\Local\Temp\6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
"C:\Users\Admin\AppData\Local\Temp\6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Users\Admin\AppData\Local\Temp\6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
  "C:\Users\Admin\AppData\Local\Temp\6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe"
  2⤵
  PID:692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/692-135-0x0000000000000000-mapping.dmp

Download
memory/692-136-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/692-138-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/692-139-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2760-130-0x0000000000E90000-0x0000000000F52000-memory.dmp

Filesize
776KB

Download
memory/2760-131-0x0000000005F00000-0x00000000064A4000-memory.dmp

Filesize
5.6MB

Download
memory/2760-132-0x0000000005950000-0x00000000059E2000-memory.dmp

Filesize
584KB

Download
memory/2760-133-0x0000000005A30000-0x0000000005A3A000-memory.dmp

Filesize
40KB

Download
memory/2760-134-0x0000000008290000-0x000000000832C000-memory.dmp

Filesize
624KB

Download

description	pid	process	target process
PID 2760 wrote to memory of 692	2760	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
PID 2760 wrote to memory of 692	2760	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
PID 2760 wrote to memory of 692	2760	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
PID 2760 wrote to memory of 692	2760	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
PID 2760 wrote to memory of 692	2760	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
PID 2760 wrote to memory of 692	2760	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
PID 2760 wrote to memory of 692	2760	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
PID 2760 wrote to memory of 692	2760	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
PID 2760 wrote to memory of 692	2760	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
PID 2760 wrote to memory of 692	2760	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
PID 2760 wrote to memory of 692	2760	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
PID 2760 wrote to memory of 692	2760	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
PID 2760 wrote to memory of 692	2760	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
PID 2760 wrote to memory of 692	2760	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
PID 2760 wrote to memory of 692	2760	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
PID 2760 wrote to memory of 692	2760	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe
PID 2760 wrote to memory of 692	2760	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe	6018a1030bfe7890c016ccfd9d7f233e7109fb54974272fabea065b243a1853d.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads