azorult | 8a07e0548084f0e3f3334cdf0c8d0b3e1c57e0b33c7df3159d6da4d11931f9ce

Analysis

max time kernel
133s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-09-2022 05:59

Target

Sipariş [Adex] 260922,pdf.exe
Size

187KB
MD5

f58ff75d00e77a904ef250a3500d45c8
SHA1

b7827dd31961c385862f71731ff017979763be4f
SHA256

8a07e0548084f0e3f3334cdf0c8d0b3e1c57e0b33c7df3159d6da4d11931f9ce
SHA512

8777553c8d603d6708dde65648206d4671f928c356e4aa90a0a7a0ba9ee6d2a12ffd5c7a91ed2eba16a44951d3465e7ba53c4b0455ea6ac6538ab3c64398eae8
SSDEEP

3072:W1hm+LhGrfWEk2RDhEtMjHY+Er2UGgEr0Llr3Lmcjj8PuOfHkSyTFq:GQ+sjxk2RDh+MzIuBEZ3LB02

Score

10^/10

Family

azorult

http://kngpdrp.shop/PL341/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

Sipariş [Adex] 260922,pdf.exe

description pid process target process

PID 4984 set thread context of 4568 4984 Sipariş [Adex] 260922,pdf.exe cvtres.exe

description	pid	process	target process
PID 4984 set thread context of 4568	4984	Sipariş [Adex] 260922,pdf.exe	cvtres.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

Sipariş [Adex] 260922,pdf.exe

description	pid	process	target process
PID 4984 wrote to memory of 4568	4984	Sipariş [Adex] 260922,pdf.exe	cvtres.exe
PID 4984 wrote to memory of 4568	4984	Sipariş [Adex] 260922,pdf.exe	cvtres.exe
PID 4984 wrote to memory of 4568	4984	Sipariş [Adex] 260922,pdf.exe	cvtres.exe
PID 4984 wrote to memory of 4568	4984	Sipariş [Adex] 260922,pdf.exe	cvtres.exe
PID 4984 wrote to memory of 4568	4984	Sipariş [Adex] 260922,pdf.exe	cvtres.exe
PID 4984 wrote to memory of 4568	4984	Sipariş [Adex] 260922,pdf.exe	cvtres.exe
PID 4984 wrote to memory of 4568	4984	Sipariş [Adex] 260922,pdf.exe	cvtres.exe
PID 4984 wrote to memory of 4568	4984	Sipariş [Adex] 260922,pdf.exe	cvtres.exe
PID 4984 wrote to memory of 4568	4984	Sipariş [Adex] 260922,pdf.exe	cvtres.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
2⤵
PID:4568

memory/4568-133-0x0000000000000000-mapping.dmp

Download
memory/4568-134-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4568-136-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4568-137-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4568-138-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4984-132-0x0000000000480000-0x00000000004B0000-memory.dmp

Filesize
192KB

Download