azorult | a1ec760dbe6e44ec5a070d8e967cf25fb54ef1981a6f2f3cb2cb4f861e0ac461

Analysis

max time kernel
58s
max time network
61s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-09-2022 07:16

Target

lZSrXwYDDkbZYDN.exe
Size

1002KB
MD5

416f3e2e12938b9627f1b898ad4a689b
SHA1

c1a34c536411f34b75c633a6551e0e78b92662c2
SHA256

f2d7275a6557c9fa6501794d6f12155813e1ffc672f65f349d3b404952b4701f
SHA512

900f606532caf15e1ecd1c6f4ce97a746774f20f549ab090420be151c293bfa39b364d6857b4c6d87162f53f13a941ce66ecece6e2c1f6978e1978ba9204bb06
SSDEEP

12288:Zqv+9fw2iNuthqXcsFEYpl8/qSLeQB9PR5ZnaOrRtIE+PPh3+MkorlulYxRqRlr:ZqMo14hqXZoXeYvX9UxCmlVAST

Score

10^/10

Family

azorult

http://ble33n.shop/PL341/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

lZSrXwYDDkbZYDN.exe

description pid process target process

PID 1788 set thread context of 1748 1788 lZSrXwYDDkbZYDN.exe lZSrXwYDDkbZYDN.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

lZSrXwYDDkbZYDN.exe

pid process

1788 lZSrXwYDDkbZYDN.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

lZSrXwYDDkbZYDN.exe

description pid process

Token: SeDebugPrivilege 1788 lZSrXwYDDkbZYDN.exe

description	pid	process	target process
PID 1788 set thread context of 1748	1788	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe

pid	process
1788	lZSrXwYDDkbZYDN.exe

description	pid	process
Token: SeDebugPrivilege	1788	lZSrXwYDDkbZYDN.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

lZSrXwYDDkbZYDN.exe

description	pid	process	target process
PID 1788 wrote to memory of 1552	1788	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 1788 wrote to memory of 1552	1788	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 1788 wrote to memory of 1552	1788	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 1788 wrote to memory of 1552	1788	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 1788 wrote to memory of 1748	1788	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 1788 wrote to memory of 1748	1788	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 1788 wrote to memory of 1748	1788	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 1788 wrote to memory of 1748	1788	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 1788 wrote to memory of 1748	1788	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 1788 wrote to memory of 1748	1788	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 1788 wrote to memory of 1748	1788	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 1788 wrote to memory of 1748	1788	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 1788 wrote to memory of 1748	1788	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 1788 wrote to memory of 1748	1788	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe

C:\Users\Admin\AppData\Local\Temp\lZSrXwYDDkbZYDN.exe
"C:\Users\Admin\AppData\Local\Temp\lZSrXwYDDkbZYDN.exe"
2⤵
PID:1552

C:\Users\Admin\AppData\Local\Temp\lZSrXwYDDkbZYDN.exe
"C:\Users\Admin\AppData\Local\Temp\lZSrXwYDDkbZYDN.exe"
2⤵
PID:1748

memory/1748-67-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1748-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1748-73-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1748-72-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1748-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1748-70-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1748-68-0x000000000041A684-mapping.dmp

Download
memory/1748-61-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1748-65-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1748-64-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1788-58-0x0000000007FC0000-0x000000000807A000-memory.dmp

Filesize
744KB

Download
memory/1788-55-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download
memory/1788-54-0x0000000001380000-0x0000000001482000-memory.dmp

Filesize
1.0MB

Download
memory/1788-59-0x00000000051A0000-0x0000000005204000-memory.dmp

Filesize
400KB

Download
memory/1788-57-0x00000000004E0000-0x00000000004EC000-memory.dmp

Filesize
48KB

Download
memory/1788-56-0x00000000004D0000-0x00000000004E4000-memory.dmp

Filesize
80KB

Download