azorult | c5650ffbaba50c167a653d678efed5b1e643500a3916ee880e361c819bda147e

Analysis

max time kernel
194s
max time network
199s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
31-07-2022 09:54

Target

c5650ffbaba50c167a653d678efed5b1e643500a3916ee880e361c819bda147e.exe
Size

139KB
MD5

928ccc36136faeaa99801bee029ced28
SHA1

af0f3015c1bff40374c65e467f636f3ee26f50a4
SHA256

c5650ffbaba50c167a653d678efed5b1e643500a3916ee880e361c819bda147e
SHA512

09eba0f5b12ead9a63f603ed528e549afe9d3677ba732481b3608e394df3cc4b2ff4313a9b2e2551bcd419d8df4e103b1bb45659e4eb539da525aae720d7e873

Score

10^/10

Family

azorult

http://195.245.112.115/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

c5650ffbaba50c167a653d678efed5b1e643500a3916ee880e361c819bda147e.exe

description	pid	process	target process
PID 2404 set thread context of 1940	2404	c5650ffbaba50c167a653d678efed5b1e643500a3916ee880e361c819bda147e.exe	c5650ffbaba50c167a653d678efed5b1e643500a3916ee880e361c819bda147e.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

c5650ffbaba50c167a653d678efed5b1e643500a3916ee880e361c819bda147e.exe

pid	process
2404	c5650ffbaba50c167a653d678efed5b1e643500a3916ee880e361c819bda147e.exe
2404	c5650ffbaba50c167a653d678efed5b1e643500a3916ee880e361c819bda147e.exe
2404	c5650ffbaba50c167a653d678efed5b1e643500a3916ee880e361c819bda147e.exe
2404	c5650ffbaba50c167a653d678efed5b1e643500a3916ee880e361c819bda147e.exe
2404	c5650ffbaba50c167a653d678efed5b1e643500a3916ee880e361c819bda147e.exe
2404	c5650ffbaba50c167a653d678efed5b1e643500a3916ee880e361c819bda147e.exe
2404	c5650ffbaba50c167a653d678efed5b1e643500a3916ee880e361c819bda147e.exe
2404	c5650ffbaba50c167a653d678efed5b1e643500a3916ee880e361c819bda147e.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

c5650ffbaba50c167a653d678efed5b1e643500a3916ee880e361c819bda147e.exe

pid process

2404 c5650ffbaba50c167a653d678efed5b1e643500a3916ee880e361c819bda147e.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c5650ffbaba50c167a653d678efed5b1e643500a3916ee880e361c819bda147e.exe

description	pid	process	target process
PID 2404 wrote to memory of 1940	2404	c5650ffbaba50c167a653d678efed5b1e643500a3916ee880e361c819bda147e.exe	c5650ffbaba50c167a653d678efed5b1e643500a3916ee880e361c819bda147e.exe
PID 2404 wrote to memory of 1940	2404	c5650ffbaba50c167a653d678efed5b1e643500a3916ee880e361c819bda147e.exe	c5650ffbaba50c167a653d678efed5b1e643500a3916ee880e361c819bda147e.exe
PID 2404 wrote to memory of 1940	2404	c5650ffbaba50c167a653d678efed5b1e643500a3916ee880e361c819bda147e.exe	c5650ffbaba50c167a653d678efed5b1e643500a3916ee880e361c819bda147e.exe
PID 2404 wrote to memory of 1940	2404	c5650ffbaba50c167a653d678efed5b1e643500a3916ee880e361c819bda147e.exe	c5650ffbaba50c167a653d678efed5b1e643500a3916ee880e361c819bda147e.exe

C:\Users\Admin\AppData\Local\Temp\c5650ffbaba50c167a653d678efed5b1e643500a3916ee880e361c819bda147e.exe
"C:\Users\Admin\AppData\Local\Temp\c5650ffbaba50c167a653d678efed5b1e643500a3916ee880e361c819bda147e.exe"
2⤵
PID:1940

memory/1940-131-0x0000000000000000-mapping.dmp

Download
memory/1940-132-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1940-133-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2404-130-0x00000000009B0000-0x00000000009B5000-memory.dmp

Filesize
20KB

Download