azorult | 18d7cdf63d95a5fd7bf6fff361655b6e8857b14d0444315b3ffca538877b9aa1

Analysis

max time kernel
91s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28-09-2022 16:32

Target

DHL-119055 de recibo,pdf.exe
Size

336KB
MD5

08bf261214d109955c81c62fb4e6cdd2
SHA1

c748b86f978631c76bbb7f631360f431cd3ac3ad
SHA256

18d7cdf63d95a5fd7bf6fff361655b6e8857b14d0444315b3ffca538877b9aa1
SHA512

e122a86e427a4fde960857bc460d31a55255b48ee29e35339a00b4f949ba3f30a96aca517f2948f870faefcf021759a18abafea6e7e86f08371dc5dba567a3a5
SSDEEP

3072:6rJZ3ZQ5F4VewO24oeK1z/JMUVoyfE5JCFZRtq971hEbaFSkjiRrP6Aq:yxO24oHz/jqJCFZeca+

Score

10^/10

Family

azorult

http://kngppdp.shop/PL341/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

DHL-119055 de recibo,pdf.exe

description pid process target process

PID 3364 set thread context of 4608 3364 DHL-119055 de recibo,pdf.exe regsvcs.exe

description	pid	process	target process
PID 3364 set thread context of 4608	3364	DHL-119055 de recibo,pdf.exe	regsvcs.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

DHL-119055 de recibo,pdf.exe

description	pid	process	target process
PID 3364 wrote to memory of 4608	3364	DHL-119055 de recibo,pdf.exe	regsvcs.exe
PID 3364 wrote to memory of 4608	3364	DHL-119055 de recibo,pdf.exe	regsvcs.exe
PID 3364 wrote to memory of 4608	3364	DHL-119055 de recibo,pdf.exe	regsvcs.exe
PID 3364 wrote to memory of 4608	3364	DHL-119055 de recibo,pdf.exe	regsvcs.exe
PID 3364 wrote to memory of 4608	3364	DHL-119055 de recibo,pdf.exe	regsvcs.exe
PID 3364 wrote to memory of 4608	3364	DHL-119055 de recibo,pdf.exe	regsvcs.exe
PID 3364 wrote to memory of 4608	3364	DHL-119055 de recibo,pdf.exe	regsvcs.exe
PID 3364 wrote to memory of 4608	3364	DHL-119055 de recibo,pdf.exe	regsvcs.exe
PID 3364 wrote to memory of 4608	3364	DHL-119055 de recibo,pdf.exe	regsvcs.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
2⤵
PID:4608

memory/3364-132-0x00000000004D0000-0x0000000000526000-memory.dmp

Filesize
344KB

Download
memory/4608-133-0x0000000000000000-mapping.dmp

Download
memory/4608-134-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4608-136-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4608-137-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4608-138-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download