azorult | a1ec760dbe6e44ec5a070d8e967cf25fb54ef1981a6f2f3cb2cb4f861e0ac461

Analysis

max time kernel
91s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-09-2022 07:16

Target

lZSrXwYDDkbZYDN.exe
Size

1002KB
MD5

416f3e2e12938b9627f1b898ad4a689b
SHA1

c1a34c536411f34b75c633a6551e0e78b92662c2
SHA256

f2d7275a6557c9fa6501794d6f12155813e1ffc672f65f349d3b404952b4701f
SHA512

900f606532caf15e1ecd1c6f4ce97a746774f20f549ab090420be151c293bfa39b364d6857b4c6d87162f53f13a941ce66ecece6e2c1f6978e1978ba9204bb06
SSDEEP

12288:Zqv+9fw2iNuthqXcsFEYpl8/qSLeQB9PR5ZnaOrRtIE+PPh3+MkorlulYxRqRlr:ZqMo14hqXZoXeYvX9UxCmlVAST

Score

10^/10

Family

azorult

http://ble33n.shop/PL341/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

lZSrXwYDDkbZYDN.exe

description pid process target process

PID 4812 set thread context of 792 4812 lZSrXwYDDkbZYDN.exe lZSrXwYDDkbZYDN.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

lZSrXwYDDkbZYDN.exe

pid process

4812 lZSrXwYDDkbZYDN.exe
4812 lZSrXwYDDkbZYDN.exe
4812 lZSrXwYDDkbZYDN.exe
4812 lZSrXwYDDkbZYDN.exe
4812 lZSrXwYDDkbZYDN.exe
4812 lZSrXwYDDkbZYDN.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

lZSrXwYDDkbZYDN.exe

description pid process

Token: SeDebugPrivilege 4812 lZSrXwYDDkbZYDN.exe

description	pid	process	target process
PID 4812 set thread context of 792	4812	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe

description	pid	process
Token: SeDebugPrivilege	4812	lZSrXwYDDkbZYDN.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

lZSrXwYDDkbZYDN.exe

description	pid	process	target process
PID 4812 wrote to memory of 1592	4812	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 4812 wrote to memory of 1592	4812	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 4812 wrote to memory of 1592	4812	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 4812 wrote to memory of 1568	4812	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 4812 wrote to memory of 1568	4812	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 4812 wrote to memory of 1568	4812	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 4812 wrote to memory of 2080	4812	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 4812 wrote to memory of 2080	4812	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 4812 wrote to memory of 2080	4812	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 4812 wrote to memory of 792	4812	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 4812 wrote to memory of 792	4812	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 4812 wrote to memory of 792	4812	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 4812 wrote to memory of 792	4812	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 4812 wrote to memory of 792	4812	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 4812 wrote to memory of 792	4812	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 4812 wrote to memory of 792	4812	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 4812 wrote to memory of 792	4812	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe
PID 4812 wrote to memory of 792	4812	lZSrXwYDDkbZYDN.exe	lZSrXwYDDkbZYDN.exe

C:\Users\Admin\AppData\Local\Temp\lZSrXwYDDkbZYDN.exe
"C:\Users\Admin\AppData\Local\Temp\lZSrXwYDDkbZYDN.exe"
2⤵
PID:1592

C:\Users\Admin\AppData\Local\Temp\lZSrXwYDDkbZYDN.exe
"C:\Users\Admin\AppData\Local\Temp\lZSrXwYDDkbZYDN.exe"
2⤵
PID:1568

C:\Users\Admin\AppData\Local\Temp\lZSrXwYDDkbZYDN.exe
"C:\Users\Admin\AppData\Local\Temp\lZSrXwYDDkbZYDN.exe"
2⤵
PID:2080

C:\Users\Admin\AppData\Local\Temp\lZSrXwYDDkbZYDN.exe
"C:\Users\Admin\AppData\Local\Temp\lZSrXwYDDkbZYDN.exe"
2⤵
PID:792

memory/792-145-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/792-144-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/792-142-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/792-141-0x0000000000000000-mapping.dmp

Download
memory/1568-139-0x0000000000000000-mapping.dmp

Download
memory/1592-138-0x0000000000000000-mapping.dmp

Download
memory/2080-140-0x0000000000000000-mapping.dmp

Download
memory/4812-132-0x0000000000450000-0x0000000000552000-memory.dmp

Filesize
1.0MB

Download
memory/4812-137-0x0000000009050000-0x00000000090B6000-memory.dmp

Filesize
408KB

Download
memory/4812-136-0x0000000008FB0000-0x000000000904C000-memory.dmp

Filesize
624KB

Download
memory/4812-135-0x0000000004F00000-0x0000000004F0A000-memory.dmp

Filesize
40KB

Download
memory/4812-134-0x0000000004F60000-0x0000000004FF2000-memory.dmp

Filesize
584KB

Download
memory/4812-133-0x0000000005470000-0x0000000005A14000-memory.dmp

Filesize
5.6MB

Download