azorult | fd059cdb330a5b2d2910af9b72bff677def44bafa176e6ffb5e6f4ddff591938

Analysis

max time kernel
146s
max time network
205s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
31-07-2022 08:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd059cdb330a5b2d2910af9b72bff677def44bafa176e6ffb5e6f4ddff591938.exe
Size

162KB
MD5

9e8132be3e88de2e1fe2966084cb6a33
SHA1

a92e14a96991fdedfc02e8aff52be3a4b93206f1
SHA256

fd059cdb330a5b2d2910af9b72bff677def44bafa176e6ffb5e6f4ddff591938
SHA512

6fbf39298852b6dce25eed232285e47631e28664fe7f07d929e6546b557512acd21572f1acebfba681565f78e351a70113c6c9d8e01b4913319fdd267479bfbe

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://83286.prohoster.biz/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

fd059cdb330a5b2d2910af9b72bff677def44bafa176e6ffb5e6f4ddff591938.exe

description	pid	process	target process
PID 2028 set thread context of 1544	2028	fd059cdb330a5b2d2910af9b72bff677def44bafa176e6ffb5e6f4ddff591938.exe	fd059cdb330a5b2d2910af9b72bff677def44bafa176e6ffb5e6f4ddff591938.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

fd059cdb330a5b2d2910af9b72bff677def44bafa176e6ffb5e6f4ddff591938.exe

description	pid	process	target process
PID 2028 wrote to memory of 1544	2028	fd059cdb330a5b2d2910af9b72bff677def44bafa176e6ffb5e6f4ddff591938.exe	fd059cdb330a5b2d2910af9b72bff677def44bafa176e6ffb5e6f4ddff591938.exe
PID 2028 wrote to memory of 1544	2028	fd059cdb330a5b2d2910af9b72bff677def44bafa176e6ffb5e6f4ddff591938.exe	fd059cdb330a5b2d2910af9b72bff677def44bafa176e6ffb5e6f4ddff591938.exe
PID 2028 wrote to memory of 1544	2028	fd059cdb330a5b2d2910af9b72bff677def44bafa176e6ffb5e6f4ddff591938.exe	fd059cdb330a5b2d2910af9b72bff677def44bafa176e6ffb5e6f4ddff591938.exe
PID 2028 wrote to memory of 1544	2028	fd059cdb330a5b2d2910af9b72bff677def44bafa176e6ffb5e6f4ddff591938.exe	fd059cdb330a5b2d2910af9b72bff677def44bafa176e6ffb5e6f4ddff591938.exe
PID 2028 wrote to memory of 1544	2028	fd059cdb330a5b2d2910af9b72bff677def44bafa176e6ffb5e6f4ddff591938.exe	fd059cdb330a5b2d2910af9b72bff677def44bafa176e6ffb5e6f4ddff591938.exe
PID 2028 wrote to memory of 1544	2028	fd059cdb330a5b2d2910af9b72bff677def44bafa176e6ffb5e6f4ddff591938.exe	fd059cdb330a5b2d2910af9b72bff677def44bafa176e6ffb5e6f4ddff591938.exe
PID 2028 wrote to memory of 1544	2028	fd059cdb330a5b2d2910af9b72bff677def44bafa176e6ffb5e6f4ddff591938.exe	fd059cdb330a5b2d2910af9b72bff677def44bafa176e6ffb5e6f4ddff591938.exe
PID 2028 wrote to memory of 1544	2028	fd059cdb330a5b2d2910af9b72bff677def44bafa176e6ffb5e6f4ddff591938.exe	fd059cdb330a5b2d2910af9b72bff677def44bafa176e6ffb5e6f4ddff591938.exe
PID 2028 wrote to memory of 1544	2028	fd059cdb330a5b2d2910af9b72bff677def44bafa176e6ffb5e6f4ddff591938.exe	fd059cdb330a5b2d2910af9b72bff677def44bafa176e6ffb5e6f4ddff591938.exe

C:\Users\Admin\AppData\Local\Temp\fd059cdb330a5b2d2910af9b72bff677def44bafa176e6ffb5e6f4ddff591938.exe
"C:\Users\Admin\AppData\Local\Temp\fd059cdb330a5b2d2910af9b72bff677def44bafa176e6ffb5e6f4ddff591938.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Users\Admin\AppData\Local\Temp\fd059cdb330a5b2d2910af9b72bff677def44bafa176e6ffb5e6f4ddff591938.exe
  "{path}"
  2⤵
  PID:1544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1544-131-0x0000000000000000-mapping.dmp

Download
memory/1544-132-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1544-134-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1544-136-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2028-130-0x0000000074D50000-0x0000000075301000-memory.dmp

Filesize
5.7MB

Download
memory/2028-135-0x0000000074D50000-0x0000000075301000-memory.dmp

Filesize
5.7MB

Download