azorult | 7d5f8cf2f98fa8be9f35d28c95b591d54594a4fcc859dacf9662c3dbdc5a3ed6

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231201-en
resource tags

arch:x64arch:x86image:win7-20231201-enlocale:en-usos:windows7-x64system
submitted
07-12-2023 07:39

Target

E-dekont.exe
Size

1.2MB
MD5

e6542eb60b7322dcd00dd536ce06dfde
SHA1

82efa9894b09019a4bba652a9f235943d650a46f
SHA256

7d5f8cf2f98fa8be9f35d28c95b591d54594a4fcc859dacf9662c3dbdc5a3ed6
SHA512

71a79076e9681c1201752a1e236d138ad38598b7314df985f70a4af95d9cfcfa6092a783d0c5ad9136cb9fe953803c648ea2e3f0003c67c81a77761464187713
SSDEEP

24576:8Fd6JansCMY5ORrtOCmuUgT6PHJ/qRZOOIRvdkTX8HWl83I:od/5irtD/ReqRZGSX8g83I

Score

10^/10

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Loads dropped DLL 1 IoCs

Processes:

E-dekont.exe

pid process

2404 E-dekont.exe
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

E-dekont.exe

pid process

2764 E-dekont.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

E-dekont.exeE-dekont.exe

pid process

2404 E-dekont.exe
2764 E-dekont.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

E-dekont.exe

description pid process target process

PID 2404 set thread context of 2764 2404 E-dekont.exe E-dekont.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

E-dekont.exe

pid process

2404 E-dekont.exe

pid	process
2404	E-dekont.exe

pid	process
2764	E-dekont.exe

pid	process
2404	E-dekont.exe
2764	E-dekont.exe

description	pid	process	target process
PID 2404 set thread context of 2764	2404	E-dekont.exe	E-dekont.exe

pid	process
2404	E-dekont.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

E-dekont.exe

description	pid	process	target process
PID 2404 wrote to memory of 2764	2404	E-dekont.exe	E-dekont.exe
PID 2404 wrote to memory of 2764	2404	E-dekont.exe	E-dekont.exe
PID 2404 wrote to memory of 2764	2404	E-dekont.exe	E-dekont.exe
PID 2404 wrote to memory of 2764	2404	E-dekont.exe	E-dekont.exe
PID 2404 wrote to memory of 2764	2404	E-dekont.exe	E-dekont.exe
PID 2404 wrote to memory of 2764	2404	E-dekont.exe	E-dekont.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\nso1C3B.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
memory/2404-28-0x00000000770C0000-0x0000000077269000-memory.dmp

Filesize
1.7MB

Download
memory/2404-29-0x00000000772B0000-0x0000000077386000-memory.dmp

Filesize
856KB

Download
memory/2404-30-0x0000000074670000-0x0000000074677000-memory.dmp

Filesize
28KB

Download
memory/2764-31-0x00000000770C0000-0x0000000077269000-memory.dmp

Filesize
1.7MB

Download
memory/2764-32-0x0000000072640000-0x00000000736A2000-memory.dmp

Filesize
16.4MB

Download
memory/2764-33-0x0000000072640000-0x00000000736A2000-memory.dmp

Filesize
16.4MB

Download
memory/2764-34-0x0000000000460000-0x0000000005657000-memory.dmp

Filesize
82.0MB

Download
memory/2764-35-0x0000000000460000-0x0000000005657000-memory.dmp

Filesize
82.0MB

Download
memory/2764-36-0x0000000072640000-0x00000000736A2000-memory.dmp

Filesize
16.4MB

Download