azorult | f2548df2e5468593394ec6ac99012131d2723f88f2e35c89f41f533a78c68330

General

Target

66c34710efa2a99389423f628d9acf8f.bin.exe
Size

813KB
MD5

66c34710efa2a99389423f628d9acf8f
SHA1

0d22f8ff37b21519ca76c513a0eee998cd098fc9
SHA256

f2548df2e5468593394ec6ac99012131d2723f88f2e35c89f41f533a78c68330
SHA512

0705cf05c72948b5661252201ec4163e800c4465e82bc3b775c4c71abe81aa25000788299571fad4679afdb0fca28fc62f2bc24ae1d150d3375679431f09a2a6
SSDEEP

12288:9pS831gCYWywOWxAksig+/UZ6BN6wnapCP0pszUR5Mi0JYNjnaG9OYqQw:JOcFxAksig+1B3n2C8WzURKc7aQw

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://billi.webhop.me/a/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Executes dropped EXE 2 IoCs

Processes:

billioe.exebillioe.exe

pid process

604 billioe.exe
1076 billioe.exe
Loads dropped DLL 2 IoCs

Processes:

66c34710efa2a99389423f628d9acf8f.bin.exe

pid process

2020 66c34710efa2a99389423f628d9acf8f.bin.exe
2020 66c34710efa2a99389423f628d9acf8f.bin.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

billioe.exe

description pid process target process

PID 604 set thread context of 1076 604 billioe.exe billioe.exe
NTFS ADS 1 IoCs

Processes:

66c34710efa2a99389423f628d9acf8f.bin.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\billiorb\billioe.exe:ZoneIdentifier 66c34710efa2a99389423f628d9acf8f.bin.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

66c34710efa2a99389423f628d9acf8f.bin.exebillioe.exe

pid process

2020 66c34710efa2a99389423f628d9acf8f.bin.exe
604 billioe.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

billioe.exe

pid process

604 billioe.exe
604 billioe.exe

pid	process
604	billioe.exe
1076	billioe.exe

pid	process
2020	66c34710efa2a99389423f628d9acf8f.bin.exe
2020	66c34710efa2a99389423f628d9acf8f.bin.exe

description	pid	process	target process
PID 604 set thread context of 1076	604	billioe.exe	billioe.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\billiorb\billioe.exe:ZoneIdentifier	66c34710efa2a99389423f628d9acf8f.bin.exe

pid	process
2020	66c34710efa2a99389423f628d9acf8f.bin.exe
604	billioe.exe

pid	process
604	billioe.exe
604	billioe.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

66c34710efa2a99389423f628d9acf8f.bin.exebillioe.exe

description	pid	process	target process
PID 2020 wrote to memory of 604	2020	66c34710efa2a99389423f628d9acf8f.bin.exe	billioe.exe
PID 2020 wrote to memory of 604	2020	66c34710efa2a99389423f628d9acf8f.bin.exe	billioe.exe
PID 2020 wrote to memory of 604	2020	66c34710efa2a99389423f628d9acf8f.bin.exe	billioe.exe
PID 2020 wrote to memory of 604	2020	66c34710efa2a99389423f628d9acf8f.bin.exe	billioe.exe
PID 604 wrote to memory of 1076	604	billioe.exe	billioe.exe
PID 604 wrote to memory of 1076	604	billioe.exe	billioe.exe
PID 604 wrote to memory of 1076	604	billioe.exe	billioe.exe
PID 604 wrote to memory of 1076	604	billioe.exe	billioe.exe

C:\Users\Admin\AppData\Local\Temp\66c34710efa2a99389423f628d9acf8f.bin.exe
"C:\Users\Admin\AppData\Local\Temp\66c34710efa2a99389423f628d9acf8f.bin.exe"
1⤵
- Loads dropped DLL
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2020

C:\Users\Admin\AppData\Roaming\billiorb\billioe.exe
"C:\Users\Admin\AppData\Roaming\billiorb\billioe.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:604

C:\Users\Admin\AppData\Roaming\billiorb\billioe.exe
"C:\Users\Admin\AppData\Roaming\billiorb\billioe.exe"
3⤵
- Executes dropped EXE
PID:1076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\billiorb\billioe.exe
Filesize
813KB

MD5
66c34710efa2a99389423f628d9acf8f

SHA1
0d22f8ff37b21519ca76c513a0eee998cd098fc9

SHA256
f2548df2e5468593394ec6ac99012131d2723f88f2e35c89f41f533a78c68330

SHA512
0705cf05c72948b5661252201ec4163e800c4465e82bc3b775c4c71abe81aa25000788299571fad4679afdb0fca28fc62f2bc24ae1d150d3375679431f09a2a6

Download Submit
C:\Users\Admin\AppData\Roaming\billiorb\billioe.exe
Filesize
813KB

MD5
66c34710efa2a99389423f628d9acf8f

SHA1
0d22f8ff37b21519ca76c513a0eee998cd098fc9

SHA256
f2548df2e5468593394ec6ac99012131d2723f88f2e35c89f41f533a78c68330

SHA512
0705cf05c72948b5661252201ec4163e800c4465e82bc3b775c4c71abe81aa25000788299571fad4679afdb0fca28fc62f2bc24ae1d150d3375679431f09a2a6

Download Submit
C:\Users\Admin\AppData\Roaming\billiorb\billioe.exe
Filesize
813KB

MD5
66c34710efa2a99389423f628d9acf8f

SHA1
0d22f8ff37b21519ca76c513a0eee998cd098fc9

SHA256
f2548df2e5468593394ec6ac99012131d2723f88f2e35c89f41f533a78c68330

SHA512
0705cf05c72948b5661252201ec4163e800c4465e82bc3b775c4c71abe81aa25000788299571fad4679afdb0fca28fc62f2bc24ae1d150d3375679431f09a2a6

Download Submit
\Users\Admin\AppData\Roaming\billiorb\billioe.exe
Filesize
813KB

MD5
66c34710efa2a99389423f628d9acf8f

SHA1
0d22f8ff37b21519ca76c513a0eee998cd098fc9

SHA256
f2548df2e5468593394ec6ac99012131d2723f88f2e35c89f41f533a78c68330

SHA512
0705cf05c72948b5661252201ec4163e800c4465e82bc3b775c4c71abe81aa25000788299571fad4679afdb0fca28fc62f2bc24ae1d150d3375679431f09a2a6

Download Submit
\Users\Admin\AppData\Roaming\billiorb\billioe.exe
Filesize
813KB

MD5
66c34710efa2a99389423f628d9acf8f

SHA1
0d22f8ff37b21519ca76c513a0eee998cd098fc9

SHA256
f2548df2e5468593394ec6ac99012131d2723f88f2e35c89f41f533a78c68330

SHA512
0705cf05c72948b5661252201ec4163e800c4465e82bc3b775c4c71abe81aa25000788299571fad4679afdb0fca28fc62f2bc24ae1d150d3375679431f09a2a6

Download Submit
memory/604-58-0x0000000000000000-mapping.dmp

Download
memory/604-64-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download
memory/1076-62-0x000000000041A1F8-mapping.dmp

Download
memory/1076-65-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1076-67-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1076-68-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2020-54-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download
memory/2020-55-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads