azorult | 8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d

Analysis

max time kernel
34s
max time network
43s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
31-07-2022 08:53

Target

8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe
Size

185KB
MD5

90ed21823e9da8599a25496e697ae3f5
SHA1

deb23721aa3da4d4b556ce2d9ef5602ab7cbb78b
SHA256

8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d
SHA512

f7cbeeea106311cc965737f023e25e0061c89ba5e4915ce39771c61ec64815fb51611479a51a8ecb4ad1aa25b674f873679d7221a58d0e57d7c97ceffde80728

Score

10^/10

Family

azorult

http://kitchenraja.in/links/32/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe

description	pid	process	target process
PID 1496 set thread context of 1792	1496	8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe	8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe

pid	process
1496	8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe
1496	8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe
1496	8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe
1496	8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe

pid process

1496 8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe

description	pid	process	target process
PID 1496 wrote to memory of 1792	1496	8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe	8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe
PID 1496 wrote to memory of 1792	1496	8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe	8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe
PID 1496 wrote to memory of 1792	1496	8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe	8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe
PID 1496 wrote to memory of 1792	1496	8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe	8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe
PID 1496 wrote to memory of 1792	1496	8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe	8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe

C:\Users\Admin\AppData\Local\Temp\8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe
"C:\Users\Admin\AppData\Local\Temp\8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe"
2⤵
PID:1792

memory/1496-54-0x0000000075C01000-0x0000000075C03000-memory.dmp

Filesize
8KB

Download
memory/1496-55-0x0000000000180000-0x0000000000185000-memory.dmp

Filesize
20KB

Download
memory/1792-56-0x000000000041A1F8-mapping.dmp

Download
memory/1792-57-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1792-59-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1792-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download