azorult | ddf04fa5a3491fe9fd6b8638e56a55671e551135700a2ac79471cbdb7bce4832

Analysis

max time kernel
64s
max time network
67s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
12-10-2022 01:20

Target

QUOTATION100722.exe
Size

1.1MB
MD5

47118e9dbe01aff26c2d745c5de287f1
SHA1

92693b6fcd143c5256aeca574f2637215a7b63f9
SHA256

ddf04fa5a3491fe9fd6b8638e56a55671e551135700a2ac79471cbdb7bce4832
SHA512

507245e2281fb053d7372c357c8b9eac8a65d3f4a254c95f0e1fc88ee825f7f987dd4c91cc25dcfbc88fa1eea9a4c2e8958e8ac1b6979ce9dbb140dfe9bb103d
SSDEEP

12288:p2iNCJ2un7NhZGCzMbrB1dbCJOVMn8dMyNNTKKeBnY6v6nnjqKoe:p1pQFGCwbF19CSdMyN7QYm6nnjqKoe

Score

10^/10

Family

azorult

http://leig.shop/leig/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

QUOTATION100722.exe

description pid process target process

PID 1352 set thread context of 588 1352 QUOTATION100722.exe QUOTATION100722.exe

description	pid	process	target process
PID 1352 set thread context of 588	1352	QUOTATION100722.exe	QUOTATION100722.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

QUOTATION100722.exe

description	pid	process	target process
PID 1352 wrote to memory of 588	1352	QUOTATION100722.exe	QUOTATION100722.exe
PID 1352 wrote to memory of 588	1352	QUOTATION100722.exe	QUOTATION100722.exe
PID 1352 wrote to memory of 588	1352	QUOTATION100722.exe	QUOTATION100722.exe
PID 1352 wrote to memory of 588	1352	QUOTATION100722.exe	QUOTATION100722.exe
PID 1352 wrote to memory of 588	1352	QUOTATION100722.exe	QUOTATION100722.exe
PID 1352 wrote to memory of 588	1352	QUOTATION100722.exe	QUOTATION100722.exe
PID 1352 wrote to memory of 588	1352	QUOTATION100722.exe	QUOTATION100722.exe
PID 1352 wrote to memory of 588	1352	QUOTATION100722.exe	QUOTATION100722.exe
PID 1352 wrote to memory of 588	1352	QUOTATION100722.exe	QUOTATION100722.exe
PID 1352 wrote to memory of 588	1352	QUOTATION100722.exe	QUOTATION100722.exe

C:\Users\Admin\AppData\Local\Temp\QUOTATION100722.exe
"C:\Users\Admin\AppData\Local\Temp\QUOTATION100722.exe"
2⤵
PID:588

memory/588-67-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/588-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/588-73-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/588-72-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/588-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/588-70-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/588-68-0x000000000041A684-mapping.dmp

Download
memory/588-61-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/588-64-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/588-65-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1352-58-0x0000000005BB0000-0x0000000005C30000-memory.dmp

Filesize
512KB

Download
memory/1352-55-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download
memory/1352-54-0x0000000000E80000-0x0000000000F94000-memory.dmp

Filesize
1.1MB

Download
memory/1352-59-0x0000000000E40000-0x0000000000E66000-memory.dmp

Filesize
152KB

Download
memory/1352-57-0x00000000009B0000-0x00000000009BC000-memory.dmp

Filesize
48KB

Download
memory/1352-56-0x0000000000980000-0x0000000000998000-memory.dmp

Filesize
96KB

Download