azorult | ddf04fa5a3491fe9fd6b8638e56a55671e551135700a2ac79471cbdb7bce4832

Analysis

max time kernel
137s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2022 01:20

Target

QUOTATION100722.exe
Size

1.1MB
MD5

47118e9dbe01aff26c2d745c5de287f1
SHA1

92693b6fcd143c5256aeca574f2637215a7b63f9
SHA256

ddf04fa5a3491fe9fd6b8638e56a55671e551135700a2ac79471cbdb7bce4832
SHA512

507245e2281fb053d7372c357c8b9eac8a65d3f4a254c95f0e1fc88ee825f7f987dd4c91cc25dcfbc88fa1eea9a4c2e8958e8ac1b6979ce9dbb140dfe9bb103d
SSDEEP

12288:p2iNCJ2un7NhZGCzMbrB1dbCJOVMn8dMyNNTKKeBnY6v6nnjqKoe:p1pQFGCwbF19CSdMyN7QYm6nnjqKoe

Score

10^/10

Family

azorult

http://leig.shop/leig/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

QUOTATION100722.exe

description pid process target process

PID 2304 set thread context of 1188 2304 QUOTATION100722.exe QUOTATION100722.exe

description	pid	process	target process
PID 2304 set thread context of 1188	2304	QUOTATION100722.exe	QUOTATION100722.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

QUOTATION100722.exe

description	pid	process	target process
PID 2304 wrote to memory of 1188	2304	QUOTATION100722.exe	QUOTATION100722.exe
PID 2304 wrote to memory of 1188	2304	QUOTATION100722.exe	QUOTATION100722.exe
PID 2304 wrote to memory of 1188	2304	QUOTATION100722.exe	QUOTATION100722.exe
PID 2304 wrote to memory of 1188	2304	QUOTATION100722.exe	QUOTATION100722.exe
PID 2304 wrote to memory of 1188	2304	QUOTATION100722.exe	QUOTATION100722.exe
PID 2304 wrote to memory of 1188	2304	QUOTATION100722.exe	QUOTATION100722.exe
PID 2304 wrote to memory of 1188	2304	QUOTATION100722.exe	QUOTATION100722.exe
PID 2304 wrote to memory of 1188	2304	QUOTATION100722.exe	QUOTATION100722.exe
PID 2304 wrote to memory of 1188	2304	QUOTATION100722.exe	QUOTATION100722.exe

C:\Users\Admin\AppData\Local\Temp\QUOTATION100722.exe
"C:\Users\Admin\AppData\Local\Temp\QUOTATION100722.exe"
2⤵
PID:1188

memory/1188-141-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1188-139-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1188-138-0x0000000000000000-mapping.dmp

Download
memory/1188-142-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1188-143-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2304-132-0x00000000009F0000-0x0000000000B04000-memory.dmp

Filesize
1.1MB

Download
memory/2304-133-0x0000000005A90000-0x0000000006034000-memory.dmp

Filesize
5.6MB

Download
memory/2304-134-0x00000000054E0000-0x0000000005572000-memory.dmp

Filesize
584KB

Download
memory/2304-135-0x00000000054A0000-0x00000000054AA000-memory.dmp

Filesize
40KB

Download
memory/2304-136-0x000000000A340000-0x000000000A3DC000-memory.dmp

Filesize
624KB

Download
memory/2304-137-0x000000000A550000-0x000000000A5B6000-memory.dmp

Filesize
408KB

Download