azorult | e8e37e4edfe4b1af00daf74ee04830467bfd9289cca5d1a550a0069cfc57e7a4

Analysis

max time kernel
8s
max time network
11s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-10-2022 08:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8e37e4edfe4b1af00daf74ee04830467bfd9289cca5d1a550a0069cfc57e7a4.exe
Size

671KB
MD5

6f1c969841a08b02db7e40a0e3de3932
SHA1

2940a4b9e71912d93ea979118272452a0d26a243
SHA256

e8e37e4edfe4b1af00daf74ee04830467bfd9289cca5d1a550a0069cfc57e7a4
SHA512

e21d0344fcd8714af2efb4f9d073311c233de080e830350dea77dec857bda5ad8f11b3766d844130b9f6197e7135b9a7df0db1968280bbc816678725524967a9
SSDEEP

12288:JrL21jKjnVJH+1tDSMdLaWfQ3uHZOx6yrCqgQ/bD9hUodsmyj5:JrGjKjnVs1tDSMdLpoAmd9dHyj

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://80.82.69.184/stat.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

Processes:

e8e37e4edfe4b1af00daf74ee04830467bfd9289cca5d1a550a0069cfc57e7a4.exe

description	pid	process	target process
PID 1416 set thread context of 2740	1416	e8e37e4edfe4b1af00daf74ee04830467bfd9289cca5d1a550a0069cfc57e7a4.exe	e8e37e4edfe4b1af00daf74ee04830467bfd9289cca5d1a550a0069cfc57e7a4.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

e8e37e4edfe4b1af00daf74ee04830467bfd9289cca5d1a550a0069cfc57e7a4.exe

description	pid	process	target process
PID 1416 wrote to memory of 2740	1416	e8e37e4edfe4b1af00daf74ee04830467bfd9289cca5d1a550a0069cfc57e7a4.exe	e8e37e4edfe4b1af00daf74ee04830467bfd9289cca5d1a550a0069cfc57e7a4.exe
PID 1416 wrote to memory of 2740	1416	e8e37e4edfe4b1af00daf74ee04830467bfd9289cca5d1a550a0069cfc57e7a4.exe	e8e37e4edfe4b1af00daf74ee04830467bfd9289cca5d1a550a0069cfc57e7a4.exe
PID 1416 wrote to memory of 2740	1416	e8e37e4edfe4b1af00daf74ee04830467bfd9289cca5d1a550a0069cfc57e7a4.exe	e8e37e4edfe4b1af00daf74ee04830467bfd9289cca5d1a550a0069cfc57e7a4.exe
PID 1416 wrote to memory of 2740	1416	e8e37e4edfe4b1af00daf74ee04830467bfd9289cca5d1a550a0069cfc57e7a4.exe	e8e37e4edfe4b1af00daf74ee04830467bfd9289cca5d1a550a0069cfc57e7a4.exe
PID 1416 wrote to memory of 2740	1416	e8e37e4edfe4b1af00daf74ee04830467bfd9289cca5d1a550a0069cfc57e7a4.exe	e8e37e4edfe4b1af00daf74ee04830467bfd9289cca5d1a550a0069cfc57e7a4.exe
PID 1416 wrote to memory of 2740	1416	e8e37e4edfe4b1af00daf74ee04830467bfd9289cca5d1a550a0069cfc57e7a4.exe	e8e37e4edfe4b1af00daf74ee04830467bfd9289cca5d1a550a0069cfc57e7a4.exe
PID 1416 wrote to memory of 2740	1416	e8e37e4edfe4b1af00daf74ee04830467bfd9289cca5d1a550a0069cfc57e7a4.exe	e8e37e4edfe4b1af00daf74ee04830467bfd9289cca5d1a550a0069cfc57e7a4.exe
PID 1416 wrote to memory of 2740	1416	e8e37e4edfe4b1af00daf74ee04830467bfd9289cca5d1a550a0069cfc57e7a4.exe	e8e37e4edfe4b1af00daf74ee04830467bfd9289cca5d1a550a0069cfc57e7a4.exe
PID 1416 wrote to memory of 2740	1416	e8e37e4edfe4b1af00daf74ee04830467bfd9289cca5d1a550a0069cfc57e7a4.exe	e8e37e4edfe4b1af00daf74ee04830467bfd9289cca5d1a550a0069cfc57e7a4.exe
PID 1416 wrote to memory of 2740	1416	e8e37e4edfe4b1af00daf74ee04830467bfd9289cca5d1a550a0069cfc57e7a4.exe	e8e37e4edfe4b1af00daf74ee04830467bfd9289cca5d1a550a0069cfc57e7a4.exe
PID 1416 wrote to memory of 2740	1416	e8e37e4edfe4b1af00daf74ee04830467bfd9289cca5d1a550a0069cfc57e7a4.exe	e8e37e4edfe4b1af00daf74ee04830467bfd9289cca5d1a550a0069cfc57e7a4.exe

C:\Users\Admin\AppData\Local\Temp\e8e37e4edfe4b1af00daf74ee04830467bfd9289cca5d1a550a0069cfc57e7a4.exe
"C:\Users\Admin\AppData\Local\Temp\e8e37e4edfe4b1af00daf74ee04830467bfd9289cca5d1a550a0069cfc57e7a4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1416

C:\Users\Admin\AppData\Local\Temp\e8e37e4edfe4b1af00daf74ee04830467bfd9289cca5d1a550a0069cfc57e7a4.exe
"C:\Users\Admin\AppData\Local\Temp\e8e37e4edfe4b1af00daf74ee04830467bfd9289cca5d1a550a0069cfc57e7a4.exe"
2⤵
PID:2740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1416-132-0x0000000000592000-0x0000000000612000-memory.dmp

Filesize
512KB

Download
memory/2740-133-0x0000000000000000-mapping.dmp

Download
memory/2740-134-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2740-136-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2740-137-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download