azorult | 5d3f38e9b563156925f9d73c5ba5f2bee3d0f0d0caf077dd65f5be3af5985a89

Analysis

max time kernel
159s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
01-08-2022 02:46

Target

5d3f38e9b563156925f9d73c5ba5f2bee3d0f0d0caf077dd65f5be3af5985a89.exe
Size

163KB
MD5

9a23881abe27dc70ca42597a1e1de354
SHA1

08db04577cf8d58de567c059f58a73b79831f231
SHA256

5d3f38e9b563156925f9d73c5ba5f2bee3d0f0d0caf077dd65f5be3af5985a89
SHA512

511301c0b6817336a747e415b148b08f3781ed74cb8f2a150a0082833c290cf4f2ab6ab834e2007d67d8988dafa4417bc25617634ab1073c8408eacffe48ce41

Score

10^/10

Family

azorult

https://cloudcitytechnologies.com/admin/32/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

5d3f38e9b563156925f9d73c5ba5f2bee3d0f0d0caf077dd65f5be3af5985a89.exe

description	pid	process	target process
PID 5032 set thread context of 4528	5032	5d3f38e9b563156925f9d73c5ba5f2bee3d0f0d0caf077dd65f5be3af5985a89.exe	5d3f38e9b563156925f9d73c5ba5f2bee3d0f0d0caf077dd65f5be3af5985a89.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

5d3f38e9b563156925f9d73c5ba5f2bee3d0f0d0caf077dd65f5be3af5985a89.exe

pid	process
5032	5d3f38e9b563156925f9d73c5ba5f2bee3d0f0d0caf077dd65f5be3af5985a89.exe
5032	5d3f38e9b563156925f9d73c5ba5f2bee3d0f0d0caf077dd65f5be3af5985a89.exe
5032	5d3f38e9b563156925f9d73c5ba5f2bee3d0f0d0caf077dd65f5be3af5985a89.exe
5032	5d3f38e9b563156925f9d73c5ba5f2bee3d0f0d0caf077dd65f5be3af5985a89.exe
5032	5d3f38e9b563156925f9d73c5ba5f2bee3d0f0d0caf077dd65f5be3af5985a89.exe
5032	5d3f38e9b563156925f9d73c5ba5f2bee3d0f0d0caf077dd65f5be3af5985a89.exe
5032	5d3f38e9b563156925f9d73c5ba5f2bee3d0f0d0caf077dd65f5be3af5985a89.exe
5032	5d3f38e9b563156925f9d73c5ba5f2bee3d0f0d0caf077dd65f5be3af5985a89.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

5d3f38e9b563156925f9d73c5ba5f2bee3d0f0d0caf077dd65f5be3af5985a89.exe

pid process

5032 5d3f38e9b563156925f9d73c5ba5f2bee3d0f0d0caf077dd65f5be3af5985a89.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

5d3f38e9b563156925f9d73c5ba5f2bee3d0f0d0caf077dd65f5be3af5985a89.exe

description	pid	process	target process
PID 5032 wrote to memory of 4528	5032	5d3f38e9b563156925f9d73c5ba5f2bee3d0f0d0caf077dd65f5be3af5985a89.exe	5d3f38e9b563156925f9d73c5ba5f2bee3d0f0d0caf077dd65f5be3af5985a89.exe
PID 5032 wrote to memory of 4528	5032	5d3f38e9b563156925f9d73c5ba5f2bee3d0f0d0caf077dd65f5be3af5985a89.exe	5d3f38e9b563156925f9d73c5ba5f2bee3d0f0d0caf077dd65f5be3af5985a89.exe
PID 5032 wrote to memory of 4528	5032	5d3f38e9b563156925f9d73c5ba5f2bee3d0f0d0caf077dd65f5be3af5985a89.exe	5d3f38e9b563156925f9d73c5ba5f2bee3d0f0d0caf077dd65f5be3af5985a89.exe
PID 5032 wrote to memory of 4528	5032	5d3f38e9b563156925f9d73c5ba5f2bee3d0f0d0caf077dd65f5be3af5985a89.exe	5d3f38e9b563156925f9d73c5ba5f2bee3d0f0d0caf077dd65f5be3af5985a89.exe

C:\Users\Admin\AppData\Local\Temp\5d3f38e9b563156925f9d73c5ba5f2bee3d0f0d0caf077dd65f5be3af5985a89.exe
"C:\Users\Admin\AppData\Local\Temp\5d3f38e9b563156925f9d73c5ba5f2bee3d0f0d0caf077dd65f5be3af5985a89.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Users\Admin\AppData\Local\Temp\5d3f38e9b563156925f9d73c5ba5f2bee3d0f0d0caf077dd65f5be3af5985a89.exe
  "C:\Users\Admin\AppData\Local\Temp\5d3f38e9b563156925f9d73c5ba5f2bee3d0f0d0caf077dd65f5be3af5985a89.exe"
  2⤵
  PID:4528

memory/4528-130-0x0000000000000000-mapping.dmp

Download
memory/4528-131-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4528-132-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4528-133-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download