azorult | 8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d

Analysis

max time kernel
90s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
31-07-2022 08:53

Target

8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe
Size

185KB
MD5

90ed21823e9da8599a25496e697ae3f5
SHA1

deb23721aa3da4d4b556ce2d9ef5602ab7cbb78b
SHA256

8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d
SHA512

f7cbeeea106311cc965737f023e25e0061c89ba5e4915ce39771c61ec64815fb51611479a51a8ecb4ad1aa25b674f873679d7221a58d0e57d7c97ceffde80728

Score

10^/10

Family

azorult

http://kitchenraja.in/links/32/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe

description	pid	process	target process
PID 4048 set thread context of 1132	4048	8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe	8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe

pid	process
4048	8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe
4048	8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe
4048	8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe
4048	8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe
4048	8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe
4048	8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe
4048	8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe
4048	8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe

pid process

4048 8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe

description	pid	process	target process
PID 4048 wrote to memory of 1132	4048	8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe	8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe
PID 4048 wrote to memory of 1132	4048	8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe	8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe
PID 4048 wrote to memory of 1132	4048	8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe	8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe
PID 4048 wrote to memory of 1132	4048	8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe	8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe

C:\Users\Admin\AppData\Local\Temp\8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe
"C:\Users\Admin\AppData\Local\Temp\8e8a0a25b513c64b2ef3180469e2c2c6b3e26a376cf0714e15a0723cee68965d.exe"
2⤵
PID:1132

memory/1132-131-0x0000000000000000-mapping.dmp

Download
memory/1132-132-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1132-133-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4048-130-0x0000000001180000-0x0000000001185000-memory.dmp

Filesize
20KB

Download