azorult | f2548df2e5468593394ec6ac99012131d2723f88f2e35c89f41f533a78c68330

Analysis

max time kernel
111s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2022 09:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66c34710efa2a99389423f628d9acf8f.bin.exe
Size

813KB
MD5

66c34710efa2a99389423f628d9acf8f
SHA1

0d22f8ff37b21519ca76c513a0eee998cd098fc9
SHA256

f2548df2e5468593394ec6ac99012131d2723f88f2e35c89f41f533a78c68330
SHA512

0705cf05c72948b5661252201ec4163e800c4465e82bc3b775c4c71abe81aa25000788299571fad4679afdb0fca28fc62f2bc24ae1d150d3375679431f09a2a6
SSDEEP

12288:9pS831gCYWywOWxAksig+/UZ6BN6wnapCP0pszUR5Mi0JYNjnaG9OYqQw:JOcFxAksig+1B3n2C8WzURKc7aQw

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://billi.webhop.me/a/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Executes dropped EXE 2 IoCs

Processes:

billioe.exebillioe.exe

pid process

1344 billioe.exe
3916 billioe.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

billioe.exe

description pid process target process

PID 1344 set thread context of 3916 1344 billioe.exe billioe.exe
NTFS ADS 1 IoCs

Processes:

66c34710efa2a99389423f628d9acf8f.bin.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\billiorb\billioe.exe:ZoneIdentifier 66c34710efa2a99389423f628d9acf8f.bin.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

66c34710efa2a99389423f628d9acf8f.bin.exebillioe.exe

pid process

1688 66c34710efa2a99389423f628d9acf8f.bin.exe
1688 66c34710efa2a99389423f628d9acf8f.bin.exe
1344 billioe.exe
1344 billioe.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

billioe.exe

pid process

1344 billioe.exe
1344 billioe.exe

pid	process
1344	billioe.exe
3916	billioe.exe

description	pid	process	target process
PID 1344 set thread context of 3916	1344	billioe.exe	billioe.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\billiorb\billioe.exe:ZoneIdentifier	66c34710efa2a99389423f628d9acf8f.bin.exe

pid	process
1688	66c34710efa2a99389423f628d9acf8f.bin.exe
1688	66c34710efa2a99389423f628d9acf8f.bin.exe
1344	billioe.exe
1344	billioe.exe

pid	process
1344	billioe.exe
1344	billioe.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

66c34710efa2a99389423f628d9acf8f.bin.exebillioe.exe

description	pid	process	target process
PID 1688 wrote to memory of 1344	1688	66c34710efa2a99389423f628d9acf8f.bin.exe	billioe.exe
PID 1688 wrote to memory of 1344	1688	66c34710efa2a99389423f628d9acf8f.bin.exe	billioe.exe
PID 1688 wrote to memory of 1344	1688	66c34710efa2a99389423f628d9acf8f.bin.exe	billioe.exe
PID 1344 wrote to memory of 3916	1344	billioe.exe	billioe.exe
PID 1344 wrote to memory of 3916	1344	billioe.exe	billioe.exe
PID 1344 wrote to memory of 3916	1344	billioe.exe	billioe.exe

C:\Users\Admin\AppData\Local\Temp\66c34710efa2a99389423f628d9acf8f.bin.exe
"C:\Users\Admin\AppData\Local\Temp\66c34710efa2a99389423f628d9acf8f.bin.exe"
1⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1688

C:\Users\Admin\AppData\Roaming\billiorb\billioe.exe
"C:\Users\Admin\AppData\Roaming\billiorb\billioe.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1344

C:\Users\Admin\AppData\Roaming\billiorb\billioe.exe
"C:\Users\Admin\AppData\Roaming\billiorb\billioe.exe"
3⤵
- Executes dropped EXE
PID:3916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\billiorb\billioe.exe
Filesize
813KB

MD5
66c34710efa2a99389423f628d9acf8f

SHA1
0d22f8ff37b21519ca76c513a0eee998cd098fc9

SHA256
f2548df2e5468593394ec6ac99012131d2723f88f2e35c89f41f533a78c68330

SHA512
0705cf05c72948b5661252201ec4163e800c4465e82bc3b775c4c71abe81aa25000788299571fad4679afdb0fca28fc62f2bc24ae1d150d3375679431f09a2a6

Download Submit
C:\Users\Admin\AppData\Roaming\billiorb\billioe.exe
Filesize
813KB

MD5
66c34710efa2a99389423f628d9acf8f

SHA1
0d22f8ff37b21519ca76c513a0eee998cd098fc9

SHA256
f2548df2e5468593394ec6ac99012131d2723f88f2e35c89f41f533a78c68330

SHA512
0705cf05c72948b5661252201ec4163e800c4465e82bc3b775c4c71abe81aa25000788299571fad4679afdb0fca28fc62f2bc24ae1d150d3375679431f09a2a6

Download Submit
C:\Users\Admin\AppData\Roaming\billiorb\billioe.exe
Filesize
813KB

MD5
66c34710efa2a99389423f628d9acf8f

SHA1
0d22f8ff37b21519ca76c513a0eee998cd098fc9

SHA256
f2548df2e5468593394ec6ac99012131d2723f88f2e35c89f41f533a78c68330

SHA512
0705cf05c72948b5661252201ec4163e800c4465e82bc3b775c4c71abe81aa25000788299571fad4679afdb0fca28fc62f2bc24ae1d150d3375679431f09a2a6

Download Submit
memory/1344-133-0x0000000000000000-mapping.dmp

Download
memory/1344-138-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download
memory/1688-132-0x0000000000400000-0x00000000004D1000-memory.dmp

Filesize
836KB

Download
memory/3916-136-0x0000000000000000-mapping.dmp

Download
memory/3916-139-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download