azorult | c4064715f49c19c5b1006837ed685971c0bca59a9e71e51e4346e5c794e612bf

Analysis

max time kernel
91s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-09-2022 08:46

Target

lZSrXwYDDkbZYDN.exe
Size

1002KB
MD5

416f3e2e12938b9627f1b898ad4a689b
SHA1

c1a34c536411f34b75c633a6551e0e78b92662c2
SHA256

f2d7275a6557c9fa6501794d6f12155813e1ffc672f65f349d3b404952b4701f
SHA512

900f606532caf15e1ecd1c6f4ce97a746774f20f549ab090420be151c293bfa39b364d6857b4c6d87162f53f13a941ce66ecece6e2c1f6978e1978ba9204bb06
SSDEEP

12288:Zqv+9fw2iNuthqXcsFEYpl8/qSLeQB9PR5ZnaOrRtIE+PPh3+MkorlulYxRqRlr:ZqMo14hqXZoXeYvX9UxCmlVAST

Score

10^/10

Family

azorult

http://ble33n.shop/PL341/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

lZSrXwYDDkbZYDN.exe

description pid process target process

PID 3140 set thread context of 216 3140 lZSrXwYDDkbZYDN.exe lZSrXwYDDkbZYDN.exe

description	pid	process	target process
PID 3140 set thread context of 216	3140	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

lZSrXwYDDkbZYDN.exe

description	pid	process	target process
PID 3140 wrote to memory of 216	3140	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 3140 wrote to memory of 216	3140	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 3140 wrote to memory of 216	3140	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 3140 wrote to memory of 216	3140	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 3140 wrote to memory of 216	3140	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 3140 wrote to memory of 216	3140	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 3140 wrote to memory of 216	3140	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 3140 wrote to memory of 216	3140	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 3140 wrote to memory of 216	3140	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe

C:\Users\Admin\AppData\Local\Temp\lZSrXwYDDkbZYDN.exe
"C:\Users\Admin\AppData\Local\Temp\lZSrXwYDDkbZYDN.exe"
2⤵
PID:216

memory/216-138-0x0000000000000000-mapping.dmp

Download
memory/216-139-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/216-141-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/216-142-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3140-132-0x0000000000B20000-0x0000000000C22000-memory.dmp

Filesize
1.0MB

Download
memory/3140-133-0x0000000005C00000-0x00000000061A4000-memory.dmp

Filesize
5.6MB

Download
memory/3140-134-0x0000000005650000-0x00000000056E2000-memory.dmp

Filesize
584KB

Download
memory/3140-135-0x00000000055D0000-0x00000000055DA000-memory.dmp

Filesize
40KB

Download
memory/3140-136-0x00000000096C0000-0x000000000975C000-memory.dmp

Filesize
624KB

Download
memory/3140-137-0x0000000009790000-0x00000000097F6000-memory.dmp

Filesize
408KB

Download