azorult | c5f1d36f5b7f70ffab8b430c730ff5b4a20d21cef6218e751ebd4feadb896b87

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20-08-2022 20:13

Target

tmp.exe
Size

718KB
MD5

5ebd9c6dad66fedf677a043d9af0b504
SHA1

0184f7abe79a218311da4c39c553bda321f2f5da
SHA256

c5f1d36f5b7f70ffab8b430c730ff5b4a20d21cef6218e751ebd4feadb896b87
SHA512

18b892f9d5ec6ba762eb31521b5d22d1ead70cf7f9f1fde947fbce3233b5f4efa0ae0c928ae499211043ae8b30332b99d0999a05dc26f28e16960db035953ae6

Score

10^/10

Family

azorult

http://208.67.105.161/kendrick/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

tmp.exe

description pid process target process

PID 1864 set thread context of 1664 1864 tmp.exe tmp.exe

description	pid	process	target process
PID 1864 set thread context of 1664	1864	tmp.exe	tmp.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

tmp.exe

description	pid	process	target process
PID 1864 wrote to memory of 1664	1864	tmp.exe	tmp.exe
PID 1864 wrote to memory of 1664	1864	tmp.exe	tmp.exe
PID 1864 wrote to memory of 1664	1864	tmp.exe	tmp.exe
PID 1864 wrote to memory of 1664	1864	tmp.exe	tmp.exe
PID 1864 wrote to memory of 1664	1864	tmp.exe	tmp.exe
PID 1864 wrote to memory of 1664	1864	tmp.exe	tmp.exe
PID 1864 wrote to memory of 1664	1864	tmp.exe	tmp.exe
PID 1864 wrote to memory of 1664	1864	tmp.exe	tmp.exe
PID 1864 wrote to memory of 1664	1864	tmp.exe	tmp.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
  2⤵
  PID:1664

memory/1664-138-0x0000000000000000-mapping.dmp

Download
memory/1664-139-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1664-141-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1664-142-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1664-143-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1664-144-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1864-132-0x00000000006D0000-0x000000000078A000-memory.dmp

Filesize
744KB

Download
memory/1864-133-0x0000000005700000-0x0000000005CA4000-memory.dmp

Filesize
5.6MB

Download
memory/1864-134-0x0000000005150000-0x00000000051E2000-memory.dmp

Filesize
584KB

Download
memory/1864-135-0x0000000005650000-0x000000000565A000-memory.dmp

Filesize
40KB

Download
memory/1864-136-0x000000000B5D0000-0x000000000B66C000-memory.dmp

Filesize
624KB

Download
memory/1864-137-0x000000000B6D0000-0x000000000B736000-memory.dmp

Filesize
408KB

Download