azorult | a49244caee6dcff5c2e97e618a0fda25bb1fa0f8a7a0d7e87a7446519fdcbc81

Analysis

max time kernel
147s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 08:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12ecdcaab5d143dd2a58f6ddfdd27d00.exe
Size

802KB
MD5

12ecdcaab5d143dd2a58f6ddfdd27d00
SHA1

c42ca28e5792e791122e5f0d3bad91cc7c48df09
SHA256

a49244caee6dcff5c2e97e618a0fda25bb1fa0f8a7a0d7e87a7446519fdcbc81
SHA512

a24a6cf9cbbf3c532930cfa0a59ad557a3c574cd1abb8ae1e12e69e2b6be4bf7df103be15e7fa2127728e62bf627bf5cc411f6b0fc4741320bef91e3c988b513
SSDEEP

12288:WRUp+gczyhNSvRbBQHR4qz91hI0zSaNsvz+yuWDVId21NaI+E8tyvX7z24Cr8+8M:GpzlQww/QTLYh6SFcwqhHk

Score

10^/10

azorult infostealer trojan

Malware Config

Extracted

Family

azorult

http://spreadgoodfiles.xyz/XcvU/index.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Suspicious use of SetThreadContext 1 IoCs

Processes:

12ecdcaab5d143dd2a58f6ddfdd27d00.exe

description pid process target process

PID 2992 set thread context of 2432 2992 12ecdcaab5d143dd2a58f6ddfdd27d00.exe 12ecdcaab5d143dd2a58f6ddfdd27d00.exe

description	pid	process	target process
PID 2992 set thread context of 2432	2992	12ecdcaab5d143dd2a58f6ddfdd27d00.exe	12ecdcaab5d143dd2a58f6ddfdd27d00.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

12ecdcaab5d143dd2a58f6ddfdd27d00.exe

description	pid	process	target process
PID 2992 wrote to memory of 2432	2992	12ecdcaab5d143dd2a58f6ddfdd27d00.exe	12ecdcaab5d143dd2a58f6ddfdd27d00.exe
PID 2992 wrote to memory of 2432	2992	12ecdcaab5d143dd2a58f6ddfdd27d00.exe	12ecdcaab5d143dd2a58f6ddfdd27d00.exe
PID 2992 wrote to memory of 2432	2992	12ecdcaab5d143dd2a58f6ddfdd27d00.exe	12ecdcaab5d143dd2a58f6ddfdd27d00.exe
PID 2992 wrote to memory of 2432	2992	12ecdcaab5d143dd2a58f6ddfdd27d00.exe	12ecdcaab5d143dd2a58f6ddfdd27d00.exe
PID 2992 wrote to memory of 2432	2992	12ecdcaab5d143dd2a58f6ddfdd27d00.exe	12ecdcaab5d143dd2a58f6ddfdd27d00.exe
PID 2992 wrote to memory of 2432	2992	12ecdcaab5d143dd2a58f6ddfdd27d00.exe	12ecdcaab5d143dd2a58f6ddfdd27d00.exe
PID 2992 wrote to memory of 2432	2992	12ecdcaab5d143dd2a58f6ddfdd27d00.exe	12ecdcaab5d143dd2a58f6ddfdd27d00.exe
PID 2992 wrote to memory of 2432	2992	12ecdcaab5d143dd2a58f6ddfdd27d00.exe	12ecdcaab5d143dd2a58f6ddfdd27d00.exe
PID 2992 wrote to memory of 2432	2992	12ecdcaab5d143dd2a58f6ddfdd27d00.exe	12ecdcaab5d143dd2a58f6ddfdd27d00.exe

C:\Users\Admin\AppData\Local\Temp\12ecdcaab5d143dd2a58f6ddfdd27d00.exe
"C:\Users\Admin\AppData\Local\Temp\12ecdcaab5d143dd2a58f6ddfdd27d00.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Users\Admin\AppData\Local\Temp\12ecdcaab5d143dd2a58f6ddfdd27d00.exe
  "{path}"
  2⤵
  PID:2432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2432-12-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2432-18-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2432-15-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2432-16-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2992-5-0x0000000005270000-0x000000000527A000-memory.dmp

Filesize
40KB

Download
memory/2992-0-0x0000000000600000-0x00000000006CE000-memory.dmp

Filesize
824KB

Download
memory/2992-7-0x0000000006790000-0x000000000682C000-memory.dmp

Filesize
624KB

Download
memory/2992-6-0x0000000005420000-0x0000000005428000-memory.dmp

Filesize
32KB

Download
memory/2992-8-0x0000000074860000-0x0000000075010000-memory.dmp

Filesize
7.7MB

Download
memory/2992-9-0x00000000052B0000-0x00000000052C0000-memory.dmp

Filesize
64KB

Download
memory/2992-10-0x0000000006B30000-0x0000000006BEA000-memory.dmp

Filesize
744KB

Download
memory/2992-11-0x00000000064F0000-0x000000000655E000-memory.dmp

Filesize
440KB

Download
memory/2992-1-0x0000000074860000-0x0000000075010000-memory.dmp

Filesize
7.7MB

Download
memory/2992-4-0x00000000052B0000-0x00000000052C0000-memory.dmp

Filesize
64KB

Download
memory/2992-17-0x0000000074860000-0x0000000075010000-memory.dmp

Filesize
7.7MB

Download
memory/2992-3-0x00000000050C0000-0x0000000005152000-memory.dmp

Filesize
584KB

Download
memory/2992-2-0x00000000055D0000-0x0000000005B74000-memory.dmp

Filesize
5.6MB

Download