azorult | c5f1d36f5b7f70ffab8b430c730ff5b4a20d21cef6218e751ebd4feadb896b87

Analysis

max time kernel
69s
max time network
71s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20-08-2022 20:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

718KB
MD5

5ebd9c6dad66fedf677a043d9af0b504
SHA1

0184f7abe79a218311da4c39c553bda321f2f5da
SHA256

c5f1d36f5b7f70ffab8b430c730ff5b4a20d21cef6218e751ebd4feadb896b87
SHA512

18b892f9d5ec6ba762eb31521b5d22d1ead70cf7f9f1fde947fbce3233b5f4efa0ae0c928ae499211043ae8b30332b99d0999a05dc26f28e16960db035953ae6

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://208.67.105.161/kendrick/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

tmp.exe

description pid process target process

PID 1096 set thread context of 2008 1096 tmp.exe tmp.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1256 2008 WerFault.exe tmp.exe

description	pid	process	target process
PID 1096 set thread context of 2008	1096	tmp.exe	tmp.exe

pid	pid_target	process	target process
1256	2008	WerFault.exe	tmp.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

tmp.exetmp.exe

description	pid	process	target process
PID 1096 wrote to memory of 2008	1096	tmp.exe	tmp.exe
PID 1096 wrote to memory of 2008	1096	tmp.exe	tmp.exe
PID 1096 wrote to memory of 2008	1096	tmp.exe	tmp.exe
PID 1096 wrote to memory of 2008	1096	tmp.exe	tmp.exe
PID 1096 wrote to memory of 2008	1096	tmp.exe	tmp.exe
PID 1096 wrote to memory of 2008	1096	tmp.exe	tmp.exe
PID 1096 wrote to memory of 2008	1096	tmp.exe	tmp.exe
PID 1096 wrote to memory of 2008	1096	tmp.exe	tmp.exe
PID 1096 wrote to memory of 2008	1096	tmp.exe	tmp.exe
PID 1096 wrote to memory of 2008	1096	tmp.exe	tmp.exe
PID 2008 wrote to memory of 1256	2008	tmp.exe	WerFault.exe
PID 2008 wrote to memory of 1256	2008	tmp.exe	WerFault.exe
PID 2008 wrote to memory of 1256	2008	tmp.exe	WerFault.exe
PID 2008 wrote to memory of 1256	2008	tmp.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 748
    3⤵
    - Program crash
    PID:1256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1096-54-0x0000000000AB0000-0x0000000000B6A000-memory.dmp

Filesize
744KB

Download
memory/1096-55-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Filesize
8KB

Download
memory/1096-56-0x00000000003B0000-0x00000000003C6000-memory.dmp

Filesize
88KB

Download
memory/1096-57-0x00000000003D0000-0x00000000003DA000-memory.dmp

Filesize
40KB

Download
memory/1096-58-0x0000000006060000-0x00000000060D0000-memory.dmp

Filesize
448KB

Download
memory/1096-59-0x0000000002220000-0x0000000002242000-memory.dmp

Filesize
136KB

Download
memory/1256-73-0x0000000000000000-mapping.dmp

Download
memory/2008-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2008-61-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2008-65-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2008-64-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2008-67-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2008-68-0x000000000041A684-mapping.dmp

Download
memory/2008-70-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2008-72-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2008-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2008-74-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download