azorult | 8b92b038889be2da5c222872fb024d7a26c991415cb048373056518c491b19ee

General

Target

8b92b038889be2da5c222872fb024d7a26c991415cb048373056518c491b19ee.exe
Size

685KB
MD5

8df71313dff890f4650214dfa0a7325f
SHA1

cbc9674b5b99c5a0ccafeee429ad3f495ef914ee
SHA256

8b92b038889be2da5c222872fb024d7a26c991415cb048373056518c491b19ee
SHA512

f3672693b540c5a184d64dd094ee1422dcd3f693285cb549eeaf368142d0400974aca96568f65f72e96a2e86f91255e6def53f27533aa2fea296b6582d6aa010
SSDEEP

12288:8yvJRBusyOgG00Fkon7epLV9nn13QxydyLXIpOB5+Z27+9p:PFud0FEfCSqXIe

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

C2

http://mchas.shop/PL341/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2208 set thread context of 2880	2208	8b92b038889be2da5c222872fb024d7a26c991415cb048373056518c491b19ee.exe	31

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2208	8b92b038889be2da5c222872fb024d7a26c991415cb048373056518c491b19ee.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2208	8b92b038889be2da5c222872fb024d7a26c991415cb048373056518c491b19ee.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2956	2208	8b92b038889be2da5c222872fb024d7a26c991415cb048373056518c491b19ee.exe	30
PID 2208 wrote to memory of 2956	2208	8b92b038889be2da5c222872fb024d7a26c991415cb048373056518c491b19ee.exe	30
PID 2208 wrote to memory of 2956	2208	8b92b038889be2da5c222872fb024d7a26c991415cb048373056518c491b19ee.exe	30
PID 2208 wrote to memory of 2956	2208	8b92b038889be2da5c222872fb024d7a26c991415cb048373056518c491b19ee.exe	30
PID 2208 wrote to memory of 2880	2208	8b92b038889be2da5c222872fb024d7a26c991415cb048373056518c491b19ee.exe	31
PID 2208 wrote to memory of 2880	2208	8b92b038889be2da5c222872fb024d7a26c991415cb048373056518c491b19ee.exe	31
PID 2208 wrote to memory of 2880	2208	8b92b038889be2da5c222872fb024d7a26c991415cb048373056518c491b19ee.exe	31
PID 2208 wrote to memory of 2880	2208	8b92b038889be2da5c222872fb024d7a26c991415cb048373056518c491b19ee.exe	31
PID 2208 wrote to memory of 2880	2208	8b92b038889be2da5c222872fb024d7a26c991415cb048373056518c491b19ee.exe	31
PID 2208 wrote to memory of 2880	2208	8b92b038889be2da5c222872fb024d7a26c991415cb048373056518c491b19ee.exe	31
PID 2208 wrote to memory of 2880	2208	8b92b038889be2da5c222872fb024d7a26c991415cb048373056518c491b19ee.exe	31
PID 2208 wrote to memory of 2880	2208	8b92b038889be2da5c222872fb024d7a26c991415cb048373056518c491b19ee.exe	31
PID 2208 wrote to memory of 2880	2208	8b92b038889be2da5c222872fb024d7a26c991415cb048373056518c491b19ee.exe	31
PID 2208 wrote to memory of 2880	2208	8b92b038889be2da5c222872fb024d7a26c991415cb048373056518c491b19ee.exe	31

C:\Users\Admin\AppData\Local\Temp\8b92b038889be2da5c222872fb024d7a26c991415cb048373056518c491b19ee.exe
"C:\Users\Admin\AppData\Local\Temp\8b92b038889be2da5c222872fb024d7a26c991415cb048373056518c491b19ee.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Users\Admin\AppData\Local\Temp\8b92b038889be2da5c222872fb024d7a26c991415cb048373056518c491b19ee.exe
  "C:\Users\Admin\AppData\Local\Temp\8b92b038889be2da5c222872fb024d7a26c991415cb048373056518c491b19ee.exe"
  2⤵
  PID:2956
- C:\Users\Admin\AppData\Local\Temp\8b92b038889be2da5c222872fb024d7a26c991415cb048373056518c491b19ee.exe
  "C:\Users\Admin\AppData\Local\Temp\8b92b038889be2da5c222872fb024d7a26c991415cb048373056518c491b19ee.exe"
  2⤵
  PID:2880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2208-70-0x0000000074160000-0x000000007484E000-memory.dmp

Filesize
6.9MB

Download
memory/2208-54-0x0000000074160000-0x000000007484E000-memory.dmp

Filesize
6.9MB

Download
memory/2208-55-0x0000000004E30000-0x0000000004E70000-memory.dmp

Filesize
256KB

Download
memory/2208-56-0x0000000000350000-0x0000000000364000-memory.dmp

Filesize
80KB

Download
memory/2208-57-0x0000000074160000-0x000000007484E000-memory.dmp

Filesize
6.9MB

Download
memory/2208-58-0x0000000004E30000-0x0000000004E70000-memory.dmp

Filesize
256KB

Download
memory/2208-59-0x00000000004C0000-0x00000000004CA000-memory.dmp

Filesize
40KB

Download
memory/2208-60-0x0000000004DD0000-0x0000000004E2E000-memory.dmp

Filesize
376KB

Download
memory/2208-53-0x0000000000020000-0x00000000000D2000-memory.dmp

Filesize
712KB

Download
memory/2880-61-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2880-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2880-64-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2880-65-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2880-66-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2880-68-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2880-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2880-71-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2880-72-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2880-73-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing