azorult | 7d5f8cf2f98fa8be9f35d28c95b591d54594a4fcc859dacf9662c3dbdc5a3ed6

Analysis

max time kernel
92s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20231130-en
resource tags

arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2023 07:39

Target

E-dekont.exe
Size

1.2MB
MD5

e6542eb60b7322dcd00dd536ce06dfde
SHA1

82efa9894b09019a4bba652a9f235943d650a46f
SHA256

7d5f8cf2f98fa8be9f35d28c95b591d54594a4fcc859dacf9662c3dbdc5a3ed6
SHA512

71a79076e9681c1201752a1e236d138ad38598b7314df985f70a4af95d9cfcfa6092a783d0c5ad9136cb9fe953803c648ea2e3f0003c67c81a77761464187713
SSDEEP

24576:8Fd6JansCMY5ORrtOCmuUgT6PHJ/qRZOOIRvdkTX8HWl83I:od/5irtD/ReqRZGSX8g83I

Score

10^/10

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Loads dropped DLL 1 IoCs

Processes:

E-dekont.exe

pid process

2148 E-dekont.exe
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

E-dekont.exe

pid process

2684 E-dekont.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

E-dekont.exeE-dekont.exe

pid process

2148 E-dekont.exe
2684 E-dekont.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

E-dekont.exe

description pid process target process

PID 2148 set thread context of 2684 2148 E-dekont.exe E-dekont.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

E-dekont.exe

pid process

2148 E-dekont.exe

pid	process
2148	E-dekont.exe

pid	process
2684	E-dekont.exe

pid	process
2148	E-dekont.exe
2684	E-dekont.exe

description	pid	process	target process
PID 2148 set thread context of 2684	2148	E-dekont.exe	E-dekont.exe

pid	process
2148	E-dekont.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

E-dekont.exe

description	pid	process	target process
PID 2148 wrote to memory of 2684	2148	E-dekont.exe	E-dekont.exe
PID 2148 wrote to memory of 2684	2148	E-dekont.exe	E-dekont.exe
PID 2148 wrote to memory of 2684	2148	E-dekont.exe	E-dekont.exe
PID 2148 wrote to memory of 2684	2148	E-dekont.exe	E-dekont.exe
PID 2148 wrote to memory of 2684	2148	E-dekont.exe	E-dekont.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsn422C.tmp\System.dll

Filesize
12KB

MD5
0d7ad4f45dc6f5aa87f606d0331c6901

SHA1
48df0911f0484cbe2a8cdd5362140b63c41ee457

SHA256
3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

SHA512
c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

Download Submit
memory/2148-27-0x00000000776A1000-0x00000000777C1000-memory.dmp

Filesize
1.1MB

Download
memory/2148-28-0x0000000074380000-0x0000000074387000-memory.dmp

Filesize
28KB

Download
memory/2684-29-0x0000000073120000-0x0000000074374000-memory.dmp

Filesize
18.3MB

Download
memory/2684-30-0x0000000077728000-0x0000000077729000-memory.dmp

Filesize
4KB

Download
memory/2684-31-0x0000000077745000-0x0000000077746000-memory.dmp

Filesize
4KB

Download
memory/2684-32-0x0000000073120000-0x0000000074374000-memory.dmp

Filesize
18.3MB

Download
memory/2684-33-0x0000000000460000-0x0000000005657000-memory.dmp

Filesize
82.0MB

Download
memory/2684-34-0x0000000000060000-0x0000000000087000-memory.dmp

Filesize
156KB

Download
memory/2684-35-0x0000000000460000-0x0000000005657000-memory.dmp

Filesize
82.0MB

Download
memory/2684-36-0x0000000073120000-0x0000000074374000-memory.dmp

Filesize
18.3MB

Download
memory/2684-37-0x00000000776A1000-0x00000000777C1000-memory.dmp

Filesize
1.1MB

Download