azorult | 6a7b530ce7035af9262e414949058513e9f0db341244250af03b8d932d7c47c3

Analysis

max time kernel
36s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 16:47

Target

6a7b530ce7035af9262e414949058513e9f0db341244250af03b8d932d7c47c3.exe
Size

710KB
MD5

919c771d279135f6474abdc43fc603d9
SHA1

9054198117ee9da213dcfcf5bddbd3611affb7f3
SHA256

6a7b530ce7035af9262e414949058513e9f0db341244250af03b8d932d7c47c3
SHA512

44bfb241516f5ac2c508c7bf2da54f814d61f32b0622745edd333f0cf2233038c571e7c0a3e4f5362138728446dbd8f79762f5fb30f12cc452ee388adfeb5fab
SSDEEP

12288:G8pRdFTK9K7lZncxtEgwDuoljBZcPIJrK7uXAq+Q3jurBw9TsrGguVNLXM1:NOK5ZncxtEgwDuolYPveAqd3jGw9Tu0S

Score

10^/10

Family

azorult

http://hapuget.host/index.php

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

6a7b530ce7035af9262e414949058513e9f0db341244250af03b8d932d7c47c3.exe

pid process

1960 6a7b530ce7035af9262e414949058513e9f0db341244250af03b8d932d7c47c3.exe

pid	process
1960	6a7b530ce7035af9262e414949058513e9f0db341244250af03b8d932d7c47c3.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

6a7b530ce7035af9262e414949058513e9f0db341244250af03b8d932d7c47c3.exe

description	pid	process	target process
PID 1960 wrote to memory of 1472	1960	6a7b530ce7035af9262e414949058513e9f0db341244250af03b8d932d7c47c3.exe	splwow64.exe
PID 1960 wrote to memory of 1472	1960	6a7b530ce7035af9262e414949058513e9f0db341244250af03b8d932d7c47c3.exe	splwow64.exe
PID 1960 wrote to memory of 1472	1960	6a7b530ce7035af9262e414949058513e9f0db341244250af03b8d932d7c47c3.exe	splwow64.exe
PID 1960 wrote to memory of 1472	1960	6a7b530ce7035af9262e414949058513e9f0db341244250af03b8d932d7c47c3.exe	splwow64.exe

memory/1472-55-0x0000000000000000-mapping.dmp

Download
memory/1472-56-0x000007FEFB881000-0x000007FEFB883000-memory.dmp

Filesize
8KB

Download
memory/1960-54-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download
memory/1960-57-0x0000000000400000-0x00000000004B7000-memory.dmp

Filesize
732KB

Download
memory/1960-58-0x0000000003550000-0x00000000035CA000-memory.dmp

Filesize
488KB

Download