azorult | 6deb2679783cdd1f005ef86488a11de88fe52443f31f0c6e481b51f307271177

Analysis

max time kernel
75s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2022 10:32

Target

6deb2679783cdd1f005ef86488a11de88fe52443f31f0c6e481b51f307271177.exe
Size

396KB
MD5

b92b398d4e25a976dc699f2099fa8452
SHA1

900e6fedf9898adbbc5f3dc7185372ffb811c8ad
SHA256

6deb2679783cdd1f005ef86488a11de88fe52443f31f0c6e481b51f307271177
SHA512

5b854a34d489a94d2b193af192cb0d9f224ef1b7d2d0cd50b119a9cd24693c720482e9ddf910b2e9e0ef44e8ad263aa4a69094b503a01ff9a177d8c2cef5f1ed
SSDEEP

6144:gaAkdaLcirZ+3WuJHukOxEaz5nccN+XPOggN2W3j0sPbyeTwV2DhiLgu0S:oGnLmyG3+fORR0sDy4C2lix0S

Score

10^/10

Family

azorult

http://195.245.112.115/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

6deb2679783cdd1f005ef86488a11de88fe52443f31f0c6e481b51f307271177.exe

description	pid	process	target process
PID 2448 set thread context of 4048	2448	6deb2679783cdd1f005ef86488a11de88fe52443f31f0c6e481b51f307271177.exe	6deb2679783cdd1f005ef86488a11de88fe52443f31f0c6e481b51f307271177.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

6deb2679783cdd1f005ef86488a11de88fe52443f31f0c6e481b51f307271177.exe

pid process

2448 6deb2679783cdd1f005ef86488a11de88fe52443f31f0c6e481b51f307271177.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

6deb2679783cdd1f005ef86488a11de88fe52443f31f0c6e481b51f307271177.exe

pid process

2448 6deb2679783cdd1f005ef86488a11de88fe52443f31f0c6e481b51f307271177.exe

pid	process
2448	6deb2679783cdd1f005ef86488a11de88fe52443f31f0c6e481b51f307271177.exe

pid	process
2448	6deb2679783cdd1f005ef86488a11de88fe52443f31f0c6e481b51f307271177.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6deb2679783cdd1f005ef86488a11de88fe52443f31f0c6e481b51f307271177.exe

description	pid	process	target process
PID 2448 wrote to memory of 4048	2448	6deb2679783cdd1f005ef86488a11de88fe52443f31f0c6e481b51f307271177.exe	6deb2679783cdd1f005ef86488a11de88fe52443f31f0c6e481b51f307271177.exe
PID 2448 wrote to memory of 4048	2448	6deb2679783cdd1f005ef86488a11de88fe52443f31f0c6e481b51f307271177.exe	6deb2679783cdd1f005ef86488a11de88fe52443f31f0c6e481b51f307271177.exe
PID 2448 wrote to memory of 4048	2448	6deb2679783cdd1f005ef86488a11de88fe52443f31f0c6e481b51f307271177.exe	6deb2679783cdd1f005ef86488a11de88fe52443f31f0c6e481b51f307271177.exe
PID 2448 wrote to memory of 4048	2448	6deb2679783cdd1f005ef86488a11de88fe52443f31f0c6e481b51f307271177.exe	6deb2679783cdd1f005ef86488a11de88fe52443f31f0c6e481b51f307271177.exe

C:\Users\Admin\AppData\Local\Temp\6deb2679783cdd1f005ef86488a11de88fe52443f31f0c6e481b51f307271177.exe
"C:\Users\Admin\AppData\Local\Temp\6deb2679783cdd1f005ef86488a11de88fe52443f31f0c6e481b51f307271177.exe"
2⤵
PID:4048

memory/2448-135-0x0000000000580000-0x0000000000588000-memory.dmp

Filesize
32KB

Download
memory/4048-134-0x0000000000000000-mapping.dmp

Download
memory/4048-136-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download