azorult | c5f1d36f5b7f70ffab8b430c730ff5b4a20d21cef6218e751ebd4feadb896b87

Analysis

max time kernel
125s
max time network
116s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18-08-2022 03:49

Target

tmp.exe
Size

718KB
MD5

5ebd9c6dad66fedf677a043d9af0b504
SHA1

0184f7abe79a218311da4c39c553bda321f2f5da
SHA256

c5f1d36f5b7f70ffab8b430c730ff5b4a20d21cef6218e751ebd4feadb896b87
SHA512

18b892f9d5ec6ba762eb31521b5d22d1ead70cf7f9f1fde947fbce3233b5f4efa0ae0c928ae499211043ae8b30332b99d0999a05dc26f28e16960db035953ae6

Score

10^/10

Family

azorult

http://208.67.105.161/kendrick/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

tmp.exe

description pid process target process

PID 1764 set thread context of 1116 1764 tmp.exe tmp.exe

description	pid	process	target process
PID 1764 set thread context of 1116	1764	tmp.exe	tmp.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

tmp.exe

description	pid	process	target process
PID 1764 wrote to memory of 1116	1764	tmp.exe	tmp.exe
PID 1764 wrote to memory of 1116	1764	tmp.exe	tmp.exe
PID 1764 wrote to memory of 1116	1764	tmp.exe	tmp.exe
PID 1764 wrote to memory of 1116	1764	tmp.exe	tmp.exe
PID 1764 wrote to memory of 1116	1764	tmp.exe	tmp.exe
PID 1764 wrote to memory of 1116	1764	tmp.exe	tmp.exe
PID 1764 wrote to memory of 1116	1764	tmp.exe	tmp.exe
PID 1764 wrote to memory of 1116	1764	tmp.exe	tmp.exe
PID 1764 wrote to memory of 1116	1764	tmp.exe	tmp.exe
PID 1764 wrote to memory of 1116	1764	tmp.exe	tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
2⤵
PID:1116

memory/1116-68-0x000000000041A684-mapping.dmp

Download
memory/1116-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1116-73-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1116-72-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1116-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1116-70-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1116-67-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1116-61-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1116-65-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1116-64-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1764-58-0x000000000A490000-0x000000000A500000-memory.dmp

Filesize
448KB

Download
memory/1764-55-0x0000000075AF1000-0x0000000075AF3000-memory.dmp

Filesize
8KB

Download
memory/1764-54-0x0000000000190000-0x000000000024A000-memory.dmp

Filesize
744KB

Download
memory/1764-59-0x0000000001FD0000-0x0000000001FF2000-memory.dmp

Filesize
136KB

Download
memory/1764-57-0x0000000000600000-0x000000000060A000-memory.dmp

Filesize
40KB

Download
memory/1764-56-0x00000000005E0000-0x00000000005F6000-memory.dmp

Filesize
88KB

Download