azorult | d5d3b0111c816adcf54d9913228c28d4f0923f902fdb58a8a0410eb39145f06f

Analysis

max time kernel
93s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2022, 19:05

Target
Payment Details,pdf.exe
Size 321KB
Sample220927-xrhdjsfchp
SHA256 d5d3b0111c816adcf54d9913228c28d4f0923f902fdb58a8a0410eb39145f06f
MD5 dd9aa37faba1afb315381ec81a5fe73b
SHA1 f8b2cdd74a0f3fabde7eff5045202af4f1da9540
SHA512 423ba2e0b8d650ae13d360098d182fd58b56d4406295a31fbf740f583448f7d7c3a4b2e397376a9cae2923045571e8b8dd9a15f643e99364acec5be390ea29db
SSDEEP 3072:PoYaziS8sdQtovkUSRys7IWzBekDNh8LqRyKmecUSRC+9wqY+mhhhmitqOT8q:gYuqov/Vs7jBb8LLKmUsCKi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4692 set thread context of 4576	4692	Payment Details,pdf.exe	78

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4692	Payment Details,pdf.exe
4692	Payment Details,pdf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4692	Payment Details,pdf.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 2496	4692	Payment Details,pdf.exe	77
PID 4692 wrote to memory of 2496	4692	Payment Details,pdf.exe	77
PID 4692 wrote to memory of 2496	4692	Payment Details,pdf.exe	77
PID 4692 wrote to memory of 4576	4692	Payment Details,pdf.exe	78
PID 4692 wrote to memory of 4576	4692	Payment Details,pdf.exe	78
PID 4692 wrote to memory of 4576	4692	Payment Details,pdf.exe	78
PID 4692 wrote to memory of 4576	4692	Payment Details,pdf.exe	78
PID 4692 wrote to memory of 4576	4692	Payment Details,pdf.exe	78
PID 4692 wrote to memory of 4576	4692	Payment Details,pdf.exe	78
PID 4692 wrote to memory of 4576	4692	Payment Details,pdf.exe	78
PID 4692 wrote to memory of 4576	4692	Payment Details,pdf.exe	78
PID 4692 wrote to memory of 4576	4692	Payment Details,pdf.exe	78

C:\Users\Admin\AppData\Local\Temp\Payment Details,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Payment Details,pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:2496
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4576

memory/4576-135-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4576-137-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4576-138-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4576-139-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4692-132-0x0000000000BF0000-0x0000000000C42000-memory.dmp

Download